discordMar 27, 2026

How Multi-Factor Authentication Helps Keep Your Discord Account Safe (opens in new tab)

Discord recommends strengthening accounts with multi-factor authentication (MFA), especially passkeys or authenticator apps. MFA adds protection beyond a password, which can be stolen, guessed, or leaked. The post explains Discord’s available login protections and emphasizes using unique passwords and securely storing recovery credentials. ## Login Verification Emails - Accounts with verified email addresses receive a verification email when signing in from a new device or location. - Users must select “Verify Login” before Discord allows access. - This protection is ineffective if the email account is compromised, particularly when the same password is reused. - Discord strongly recommends using a different password for every online account. ## How Multi-Factor Authentication Works - MFA adds one or more authentication factors beyond a password: - **Something you know:** A password or secret phrase. - **Something you have:** A phone, computer, security key, or other device. - **Something you are:** A fingerprint or facial biometric. - Using multiple factors makes account takeover more difficult. - Enabling any MFA option disables login verification emails. ## Passkeys - Passkeys are presented as Discord’s fastest and most secure option because they are practically phishing-resistant. - They use a cryptographic exchange between Discord and a device, unlocked with a fingerprint, face scan, or device PIN. - Biometric data stays on the user’s device; Discord receives only the cryptographic credential needed to approve the login. - Discord supports up to 16 passkeys per account, including passkeys stored in password managers, browsers, mobile devices, or hardware security keys. - Users are encouraged to keep a backup passkey in a credential manager such as 1Password or Bitwarden. ## Authenticator Apps - Authenticator apps generate time-based one-time passwords. - Discord and the app share a secret starter value, allowing them to generate matching codes. - A new code is created every 30 seconds, while Discord also accepts the previous code to provide roughly a one-minute login window. - Supported apps include Authy, Microsoft Authenticator, and Google Authenticator. - Backup codes should be saved in a password manager or another secure, reliable location. - Backup codes can be regenerated through **My Account > View Backup Codes > Generate New Backup Codes**. ## Recommended Account Protection - Enable MFA on every Discord account. - Prefer one or more passkeys. - Use an authenticator app if passkeys are unavailable. - Use unique passwords across all services. - Store passkeys and backup codes securely, with a backup recovery method available. Overall, Discord recommends passkeys as the strongest option, with authenticator apps as the next-best choice. Login verification emails provide basic protection, but MFA offers substantially stronger defense against stolen or reused passwords.

passkeysmulti-factor-authenticationcryptographybiometrics+4

gitlabFeb 25, 2026

Passkeys now available for passwordless sign-in and 2FA on GitLab (opens in new tab)

GitLab now supports passkeys for passwordless sign-in and phishing-resistant two-factor authentication. Built on WebAuthn and public-key cryptography, passkeys let users authenticate with a fingerprint, face recognition, or device PIN while keeping the private key on their device. Users can register multiple passkeys across browsers, mobile devices, and FIDO2 security keys, improving both security and convenience. ## Passkeys for Sign-In and 2FA - Passkeys can be used: - As a passwordless login method. - As a phishing-resistant 2FA method. - For accounts with 2FA enabled, passkeys automatically become the default 2FA option. - Authentication uses a device fingerprint, facial recognition, or PIN. ## Registration and Compatibility - Users can register passkeys under **Profile settings > Account > Manage authentication**. - Supported platforms include: - Chrome, Firefox, Safari, and Edge. - iOS 16 and later. - Android 9 and later. - FIDO2 hardware security keys. - Multiple passkeys can be registered for access across different devices. ## WebAuthn Security Model - Passkeys rely on WebAuthn and public-key cryptography. - The private key remains securely stored on the user’s device and is never sent to GitLab. - GitLab stores only the public key. - A breach of GitLab’s stored credentials would not give attackers usable private keys for account access. ## GitLab’s Security Goals - Passkeys support GitLab’s commitment under the CISA Secure by Design Pledge. - They help increase MFA adoption while providing a smoother, phishing-resistant authentication experience. - GitLab invites users to provide feedback through its community and feedback channels. Users should register passkeys in their GitLab authentication settings, ideally across multiple trusted devices or security keys for both stronger protection and account recovery.

passkeysgitlabdevsecopssecurity+4

metaFeb 4, 2026

No Display? No Problem: Cross-Device Passkey Authentication for XR Devices (opens in new tab)

Passkeys provide phishing-resistant authentication, but standard cross-device flows depend on QR codes displayed on the device being authenticated. This creates a problem for XR headsets, smart-home hubs, sensors, and other devices with no accessible screen. The proposed solution uses an authenticated companion app to transport the FIDO hybrid-flow request, preserving proximity, trust, and standard WebAuthn security without requiring a QR code. ## The Challenge: Screenless Devices Cannot Display QR Codes - Traditional cross-device passkey authentication uses: - A QR code displayed by the desktop or other target device. - Bluetooth or NFC to verify proximity and establish communication. - Devices without usable displays cannot show a QR code for a phone to scan. - Proximity discovery alone is insufficient because users still need a clear, secure way to approve the correct authentication request. ## Companion Apps as Secure Message Transport - The target device generates the same hybrid-flow request normally encoded in a QR code. - Instead of displaying it, the device sends the request to an authenticated companion app associated with the same user account. - In-app notifications provide a user-consent surface and direct the user into the passkey flow. - Opening the app itself can initiate the flow because the user must deliberately open it, and mobile operating systems provide an additional verification step. ## Meta Quest and Meta Horizon Implementation - The implementation is broadly available on Meta Quest devices running Meta Horizon OS. - The Quest browser creates a FIDO URL containing: - A fresh ECDH public key. - A session-specific secret. - Routing information for the hybrid handshake. - The URL is packaged as structured data in a GraphQL-based push notification. - The Meta Horizon app validates that the request belongs to the correct signed-in user before processing it. ## Notification and Deep-Link Flow - iOS or Android displays a notification that a passkey login is pending. - Tapping the notification opens the Meta Horizon app, which launches the FIDO URL through the operating system. - The OS then invokes its passkey interface. - If notifications are disabled, opening the app queries the backend for pending requests. - Requests expire after five minutes, limiting the window for misuse. - The mobile device then performs the normal hybrid transport process: - Broadcasting a BLE advertisement. - Establishing an encrypted tunnel. - Generating the passkey assertion. ## WebAuthn Challenge and Response - The inaccessible device creates the normal WebAuthn challenge and waits for a response. - The mobile authenticator initiates the secure BLE or NFC connection. - The challenge travels through the encrypted channel. - After successful user verification, the phone creates an `AuthenticatorAssertionResponse` or `AuthenticatorAttestationResponse`. - The inaccessible device forwards that response to the relying-party server just as a display-equipped device would. ## Broader Impact - The approach removes the QR-code requirement while retaining FIDO hybrid transport and proximity protections. - It could extend passwordless authentication to: - XR headsets and wearables. - Screenless IoT devices. - Smart-home hubs. - Industrial sensors and hardware. - The work builds on FIDO Alliance standards and mobile operating-system support, helping broaden interoperability across device ecosystems. The companion-app model offers a practical way to bring secure cross-device passkeys to devices that cannot display QR codes. It is especially suitable where the device already has an authenticated mobile app and can rely on standard WebAuthn, BLE/NFC proximity, and platform user verification.

passkeysgraphqlwebauthniot-security+4

discordDec 15, 2025

Discord Patch Notes: November 4, 2025 (opens in new tab)

Discord’s November 4, 2025 patch focuses on faster startup and calls, more reliable streaming, improved notification processing, and a broad set of platform-specific fixes. Audio devices now initialize during call connection, reducing connection times by roughly 5–15%, while asset-fetch retries have reduced startup failures by about 80%. The release also improves Roblox streaming, iOS notification emojis, accessibility, navigation, and chat rendering. ## Performance and Reliability - Roblox streams on PC should no longer appear as blank or white frames, thanks to a more reliable capture pipeline. - Audio devices such as microphones now start while a call is connecting rather than afterward. - Notification targeting is up to five times faster, improving notification availability. - Asset-loading retries have significantly reduced startup failures that previously required closing and relaunching Discord. ## General Improvements - Desktop Quick Switcher returns more results when searching without a type filter. - Server administrators can now apply age restrictions to servers. - Discord fixed incorrect content-type headers for text attachments, including subtitle files. - Apple Maps link embeds work again. - Overlay dismissal correctly returns focus to the game. - Passkey prompts no longer appear when a passkey is already enabled. - Numerous layout, localization, tooltip, profile-editing, status, badge, and scrolling issues were corrected across desktop and mobile. ## Mobile and Platform Fixes - Custom emojis now render in iOS notifications. - Android fixes address unwanted vibration in Appearance settings, swipe navigation, role-management state resets, server-list rendering, chat loading, and bottom-navigation text truncation. - iOS fixes improve emoji-picker navigation, event controls, username rendering, server-join text, and message editing. - Desktop fixes include muted badge colors, profile-preview overlap, status resets, profile-editor blank screens, and localized button tooltips. ## Chat and Messaging - Fixed message spacing, forwarding layouts, reply-preview emoji overlap, and text-input positioning on iOS and desktop. - Android chat should no longer display a gray screen. - Forum-channel links and Markdown previews now render correctly. - Dark-mode forum previews no longer display links and mentions in black. - Spoilers render interactively and consistently, including inside code blocks. - Fixed potential crashes and visual issues when reacting to messages on iOS. - Desktop channel notification menus now display all available options. The patch is primarily a reliability and polish release, with the largest user-facing benefits coming from faster call connections, fewer startup failures, and more dependable streaming. Fixes may continue rolling out across platforms after publication.

passkeysdiscordandroidios+4

discordFeb 26, 2025

Discord Update: September 26, 2024 Changelog (opens in new tab)

Discord’s September 2024 update centers on transforming the platform into a more interactive entertainment hub while significantly hardening its security infrastructure. By centralizing third-party integrations through a new App Launcher and implementing end-to-end encryption for audio and video, the platform aims to balance expanded developer functionality with robust user privacy. ### The App Launcher and Interactive Activities * The newly launched App Launcher is now available across desktop and mobile, allowing users to search, browse curated collections, and add thousands of apps directly to their accounts for use in chats and voice calls. * Four new Activities have been integrated: *Arena Kingdoms* for cross-server battles, *Echo Chess* for daily puzzles, the Viking-themed *Battletabs*, and the social-focused *Magic Circle*. * New image-editing capabilities allow users to hover over chat images to access the App Launcher for quick modifications, such as adding captions or using Viggle’s “Animate” command to generate motion from static photos. * The developer ecosystem has been expanded to allow third parties to build, launch, and monetize their own Activities, with options to opt-in to platform-wide discovery via the launcher. ### Security and Privacy Enhancements * End-to-End Encryption (E2EE) is being introduced for all audio and video communication, including DMs, Group DMs, voice channels, and Go Live streams, ensuring that stream data is accessible only to participants. * Support for Passkeys has been implemented, allowing users to replace traditional passwords with biometric authentication such as Face ID or Touch ID. * Passkey technology remains localized to the user's device, ensuring that Discord does not have access to sensitive biometric data. ### Platform Performance and Community Resources * Discord’s engineering team reported a significant performance milestone, reducing iOS application crashes by 84%. * The "Discord Dojo" initiative has launched to provide educational content, including videos and blogs focused on message formatting and advanced keybinds for power users. * A new partnership with *Street Fighter 6* introduces themed shop items and a specific Quest that rewards users with a "Battle Field" decoration for their profiles. To maintain the highest level of account safety, users should consider migrating to Passkeys and verifying the encryption status during their next voice or video call. For those looking to increase engagement within their servers, the App Launcher provides a low-friction way to introduce collaborative games and media tools directly into existing conversations.

passkeysiosperformance-optimizationend-to-end-encryption+3