MeridianMeridian

WhatsApp Adds Support for Multiple Passkeys on Single Account

WhatsApp has expanded its account protection features by allowing users to register more than one passkey on the same profile. The update particularly benefits users who switch between Android and iOS devices while maintaining phishing-resistant login methods. Passkeys replace traditional codes and passwords with biometric authentication, facial recognition, or device lock mechanisms. Meta reports that more than one billion people already use the feature on WhatsApp, with Android support introduced in 2023 and iOS support added in 2024. The change reduces reliance on a single device during authentication by associating multiple keys with one account. Users can manage keys through Settings > Account > Passkeys. WhatsApp has also strengthened two-factor verification by allowing replacement of the six-digit PIN with longer passwords containing letters, numbers, and special characters.

BoletimSecTranslated from Portuguese

Read at source

WhatsApp has expanded account protection by now allowing users to register multiple passkeys on the same profile. The update primarily benefits individuals who switch between Android and iOS devices while seeking phishing-resistant login methods.

Passkeys replace traditional codes and passwords with authentication based on biometrics, facial recognition, or the device lock itself. According to Meta, more than one billion people already use the feature on WhatsApp. Support began on Android in 2023 and reached iOS in 2024.

With the new capability, different keys can be linked to the same account, reducing dependence on any single device during authentication. Users can manage registered keys in Settings > Account > Passkeys.

The technology makes it harder for attackers to capture credentials through fake pages, since authentication remains tied to the legitimate device and service. WhatsApp has also reinforced two-factor verification. The previous six-digit PIN can now be replaced by a longer password containing letters, numbers, and special characters, increasing resistance to guessing or account takeover attempts.

The recommendation remains to enable passkeys whenever available, strengthen two-factor verification, and remain cautious of requests for access codes. WhatsApp states it will continue expanding mechanisms for account protection and recovery.

MetaWhatsAppAndroidiOS
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Privacy & Surveillance

Maximizing iPhone Privacy: Essential Settings to Enable, Disable, and Verify Immediately
Privacy & Surveillance

Maximizing iPhone Privacy: Essential Settings to Enable, Disable, and Verify Immediately

The article provides a detailed guide on strengthening iPhone privacy by limiting unauthorized access to messages, location data, photos, and cloud backups. It explains how to set a strong alphanumeric passcode, enable Stolen Device Protection, and restrict lock screen notifications and widgets. Users are advised to review Apple ID security, enable Advanced Data Protection for iCloud, and minimize app permissions for location, contacts, and camera. Additional steps include turning off cross-app tracking, using private Wi-Fi addresses, and activating Lockdown Mode for high-risk scenarios. The guide emphasizes regular updates, encrypted local backups, and periodic audits of shared access and active sessions to maintain long-term protection.

SecuritylabOct 28, 2026Translated from Russian

Top 10 Secure DNS Servers for Privacy, Threat Blocking and Ad Filtering in 2026
Privacy & Surveillance

Top 10 Secure DNS Servers for Privacy, Threat Blocking and Ad Filtering in 2026

Public DNS resolvers differ significantly in their ability to block malicious domains, filter advertising and tracking, respect user privacy, and support modern encryption protocols. The guide evaluates ten services including Quad9, Cloudflare, AdGuard DNS, NextDNS, Control D, CleanBrowsing, Mullvad DNS, DNS4EU, Google Public DNS and DNS.SB, providing IPv4 addresses, DoH and DoT endpoints, and recommended use cases. Key distinctions include Quad9’s focus on phishing and malware blocking without logging, Mullvad’s strict no-logs policy requiring encrypted protocols only, and DNS4EU’s EU-based infrastructure with mandatory court-ordered blocks. The article explains why DNSSEC and encryption alone are insufficient and outlines four practical selection criteria: threat filtering quality, data-handling practices, encryption support, and network stability. Detailed configuration instructions cover Windows 11, Android, iOS, and home routers, along with verification methods and warnings against mixing providers with conflicting policies.

SecuritylabOct 28, 2026Translated from Russian

WebRTC IP Leaks Explained: Why Disabling the Protocol Harms Anonymity in Anti-Detect Browsers
Privacy & Surveillance

WebRTC IP Leaks Explained: Why Disabling the Protocol Harms Anonymity in Anti-Detect Browsers

The article from Aurorium details how WebRTC technology can leak real IP addresses even when users route traffic through proxies. It explains the peer-to-peer mechanics of WebRTC, the role of STUN servers in generating ICE candidates, and why standard TCP proxies fail to handle UDP traffic. Disabling WebRTC via flags or JavaScript extensions creates detectable anomalies that anti-fraud systems flag as non-standard environments. The recommended approach involves native emulation inside the browser kernel so that STUN requests return proxy IPs while preserving full API integrity across workers. Additional leaks through local network addresses, mDNS candidates, and IPv6 are also covered with practical verification methods using tools like BrowserLeaks and CreepJS.

HabrOct 26, 2026Translated from Russian