discordJun 4, 2026

Discord Patch Notes: June 4, 2026 (opens in new tab)

Discord’s June 4, 2026 patch focuses on usability, performance, accessibility, and bug fixes across desktop, Android, and iOS. Major updates include a mobile call-confirmation prompt, an 8% improvement in median desktop startup time, a redesigned Account settings page, and a clearer voice-invite embed. The release also addresses numerous layout, navigation, accessibility, and platform-specific issues. ## New Features and Improvements - **Mobile call confirmation** - Adds a confirmation step after tapping call buttons in direct messages. - Helps prevent accidental calls. - **Faster desktop startup** - Improved median startup times by approximately 8%, or around 650 milliseconds. - Additional performance work is planned. - **Redesigned Account settings** - Updates visuals and wording to match the broader User Settings redesign. - Moves Devices, Family Center, Account Standing, and Multi-Factor Authentication into nested Account pages. - **Improved voice-invite embeds** - Displays the relevant server and channel. - Shows the number of users currently in the voice channel. - Adds animated avatars and hover details for usernames. ## General Bug Fixes - Fixed Android custom status text crowding the clear button. - Corrected iOS event behavior involving external Markdown links, mentions, sharing, QR login, themes, notifications, and profile images. - Fixed guest server invites getting stuck in onboarding or application flows. - Improved handling of long nicknames, wrapped time indicators, event descriptions, community announcements, and high zoom levels on desktop. - Corrected inaccurate Android search results when combining `has:forward` with Media, Links, or Files filters. - Fixed mobile navigation issues, including the Set Status back button. - Prevented empty Bluesky handle submissions from bypassing form validation. - Removed incorrect or unreachable keyboard shortcut hints and scrollbars. - Improved tab navigation and focus behavior for accessibility. - Fixed visual inconsistencies involving rounded corners, themes, font scaling, gradients, cursors, borders, and tinting. - Corrected invite, server discovery, event, and profile interactions that opened the wrong view or failed silently. - Improved behavior at high zoom levels and in smaller windows, including Shop filters and Event Details modals. The patch is intended to make Discord more reliable and polished across platforms. Users may not receive every fix immediately because the changes are still rolling out individually.

multi-factor-authenticationdiscordandroidios+4

discordMar 27, 2026

How Multi-Factor Authentication Helps Keep Your Discord Account Safe (opens in new tab)

Discord recommends strengthening accounts with multi-factor authentication (MFA), especially passkeys or authenticator apps. MFA adds protection beyond a password, which can be stolen, guessed, or leaked. The post explains Discord’s available login protections and emphasizes using unique passwords and securely storing recovery credentials. ## Login Verification Emails - Accounts with verified email addresses receive a verification email when signing in from a new device or location. - Users must select “Verify Login” before Discord allows access. - This protection is ineffective if the email account is compromised, particularly when the same password is reused. - Discord strongly recommends using a different password for every online account. ## How Multi-Factor Authentication Works - MFA adds one or more authentication factors beyond a password: - **Something you know:** A password or secret phrase. - **Something you have:** A phone, computer, security key, or other device. - **Something you are:** A fingerprint or facial biometric. - Using multiple factors makes account takeover more difficult. - Enabling any MFA option disables login verification emails. ## Passkeys - Passkeys are presented as Discord’s fastest and most secure option because they are practically phishing-resistant. - They use a cryptographic exchange between Discord and a device, unlocked with a fingerprint, face scan, or device PIN. - Biometric data stays on the user’s device; Discord receives only the cryptographic credential needed to approve the login. - Discord supports up to 16 passkeys per account, including passkeys stored in password managers, browsers, mobile devices, or hardware security keys. - Users are encouraged to keep a backup passkey in a credential manager such as 1Password or Bitwarden. ## Authenticator Apps - Authenticator apps generate time-based one-time passwords. - Discord and the app share a secret starter value, allowing them to generate matching codes. - A new code is created every 30 seconds, while Discord also accepts the previous code to provide roughly a one-minute login window. - Supported apps include Authy, Microsoft Authenticator, and Google Authenticator. - Backup codes should be saved in a password manager or another secure, reliable location. - Backup codes can be regenerated through **My Account > View Backup Codes > Generate New Backup Codes**. ## Recommended Account Protection - Enable MFA on every Discord account. - Prefer one or more passkeys. - Use an authenticator app if passkeys are unavailable. - Use unique passwords across all services. - Store passkeys and backup codes securely, with a backup recovery method available. Overall, Discord recommends passkeys as the strongest option, with authenticator apps as the next-best choice. Login verification emails provide basic protection, but MFA offers substantially stronger defense against stolen or reused passwords.

multi-factor-authenticationpasskeyscryptographybiometrics+4

cloudflareMar 16, 2026

From legacy architecture to Cloudflare One (opens in new tab)

Moving from fragmented VPNs to Cloudflare One is presented as a gradual modernization effort rather than a risky “big bang” cutover. Cloudflare and CDW recommend a tiered, application-aware migration that combines Zero Trust controls with careful dependency analysis and staged deployment. The central conclusion is that legacy applications can gain modern security protections without immediate code rewrites or major downtime. ## Reducing Big-Bang Migration Risk - Large organizations may need to transition hundreds or thousands of applications and users from legacy VPNs. - A single firewall error, dependency failure, or session timeout can disrupt essential services. - These risks often prevent organizations from adopting Zero Trust despite vulnerable, aging infrastructure. - CDW applies lessons from failed deployments to create a risk-aware migration roadmap. - Applications are categorized by complexity, with simpler systems migrated first and legacy systems handled later under tighter controls. - A public-sector migration of 500 applications caused widespread disruption because more than 4,000 applications had not been prioritized or tiered. ## Treating Migration as Application Modernization - Traditional migrations often treat networks as basic connectivity infrastructure and overlook application ecosystems. - CDW analyzes: - Backend databases and APIs - Identity and authentication dependencies - Hidden service-to-service calls - Legacy session behavior - Security requirements are incorporated into the architecture from the beginning rather than added after connectivity is restored. - The migration becomes an application modernization program instead of a simple VPN replacement. ## Protecting Legacy Applications with Cloudflare Access - Cloudflare Access replaces broad network-level VPN access with request-by-request Zero Trust authorization. - Each request can be evaluated using: - User identity - Device posture - Hardware-based MFA - Other contextual signals - This limits lateral movement and reduces the attack surface. - Legacy applications can be “wrapped” with modern security controls without rewriting their code. - Cloudflare Tunnel provides: - An outbound-only connection - SSO and MFA integration - No public IP exposure for the application - Access policies can require endpoint MFA and a device health check before traffic reaches the server. - This approach allows organizations to modernize security incrementally while legacy applications continue operating. ## Pre-Migration Audit ### Architectural and Identity Assessment - Identify whether applications use a federated identity provider such as Okta or legacy local directories. - Map database, API, and backend dependencies. - Verify that hidden API calls and service-token-based Tunnel connections will continue functioning after migration. - Assess whether applying least-privilege controls could break application behavior. ### Establishing a Strategy and Implementation Firebreak - Create separate groups for: - Security strategy and standards - Deployment and operational implementation - This separation prevents deployment speed from overriding requirements designed to limit lateral movement. ### Testing Persistent Sessions - Identify applications that depend on persistent sessions, particularly for users switching between cellular towers. - Cloudflare’s edge architecture and Dynamic Path MTU Discovery (PMTUD) help maintain sessions even when client IP addresses change. - This assessment can identify opportunities to replace rigid legacy hardware with a modern single-pass architecture. ### Categorizing Applications and Setting Timelines - **Tier 0: Modern SaaS applications** - Native SAML/OIDC support - Cloudflare can act as a clientless identity-provider proxy - Estimated effort: 1–3 hours per application - **Tier 1: Internal web applications** - Support identity headers and modern web protocols - Use a clientless reverse proxy with Cloudflare Tunnel - Estimated effort: 3–6 hours per application - **Tier 2: Non-web client-server applications** - Require specific port/protocol support or thick-client configurations - Use both Cloudflare One Client and Cloudflare Tunnel - Estimated effort: 4–8 hours per application A phased migration built around application dependencies, identity readiness, session behavior, and technical complexity offers a safer path to Cloudflare One. Organizations should begin with an audit and pilot, secure legacy applications using Access and Tunnel, and expand tier by tier rather than attempting a single cutover.

multi-factor-authenticationdatabase-designcloudflarezero-trust+4

cloudflareMar 4, 2026

Mind the gap: new tools for continuous enforcement from boot to login (opens in new tab)

Cloudflare introduces two tools to enforce security continuously from device boot through application access: mandatory authentication and independent MFA. Mandatory authentication prevents unauthenticated devices from accessing the Internet, while Cloudflare MFA adds a second trust authority beyond the identity provider. Together, they reduce visibility gaps and limit the impact of compromised credentials. ## Closing the Authentication Gap - Cloudflare One Client provides policy enforcement and traffic inspection, but historically left devices exposed before a user authenticated or after a session expired. - In these “unknown device” states, users could potentially bypass controls using local machine connectivity. - Mandatory authentication, configured through MDM, makes the client enforce access from system boot: - Blocks Internet traffic using the system firewall. - Permits only the client’s authentication flow through a process-specific exception. - Prompts users to authenticate directly. - The feature will initially support Windows, with other platforms planned. ## Independent MFA at the Network Edge - SSO providers such as Okta, Entra ID, and Google are valuable security anchors but also high-value targets. - If an attacker hijacks an SSO session, they may gain access to every connected application. - Cloudflare MFA provides an independent, network-edge “step-up” factor, requiring attackers to overcome a second authority even if the primary IdP is compromised. - Supported methods include: - Biometrics such as Windows Hello, Touch ID, and Face ID. - WebAuthn, FIDO2, and PIV security keys. - TOTP authenticator applications. ## Granular Policy Enforcement - Administrators can require MFA globally, per application, or within specific access policies. - Organizations can match authentication strength to resource sensitivity—for example, weaker methods for chat and security keys for source-code repositories. - Strong MFA can be imposed on contractors using personal identities or social logins. - Legacy applications can receive modern MFA protection without code changes. - Cloudflare’s independent MFA is currently in closed beta. ## Reducing Attack Impact - Requiring authentication before Internet access ensures managed devices remain registered and visible. - Independent MFA reduces the blast radius of stolen passwords or compromised SSO sessions. - Cloudflare positions these capabilities as part of a broader move toward continuous, automated security posture enforcement. Organizations using Cloudflare One should consider mandatory authentication for managed endpoints and independent, risk-based MFA for sensitive applications.

multi-factor-authenticationcloudflarezero-trustnetwork-security+3

gitlabFeb 25, 2026

Passkeys now available for passwordless sign-in and 2FA on GitLab (opens in new tab)

GitLab now supports passkeys for passwordless sign-in and phishing-resistant two-factor authentication. Built on WebAuthn and public-key cryptography, passkeys let users authenticate with a fingerprint, face recognition, or device PIN while keeping the private key on their device. Users can register multiple passkeys across browsers, mobile devices, and FIDO2 security keys, improving both security and convenience. ## Passkeys for Sign-In and 2FA - Passkeys can be used: - As a passwordless login method. - As a phishing-resistant 2FA method. - For accounts with 2FA enabled, passkeys automatically become the default 2FA option. - Authentication uses a device fingerprint, facial recognition, or PIN. ## Registration and Compatibility - Users can register passkeys under **Profile settings > Account > Manage authentication**. - Supported platforms include: - Chrome, Firefox, Safari, and Edge. - iOS 16 and later. - Android 9 and later. - FIDO2 hardware security keys. - Multiple passkeys can be registered for access across different devices. ## WebAuthn Security Model - Passkeys rely on WebAuthn and public-key cryptography. - The private key remains securely stored on the user’s device and is never sent to GitLab. - GitLab stores only the public key. - A breach of GitLab’s stored credentials would not give attackers usable private keys for account access. ## GitLab’s Security Goals - Passkeys support GitLab’s commitment under the CISA Secure by Design Pledge. - They help increase MFA adoption while providing a smoother, phishing-resistant authentication experience. - GitLab invites users to provide feedback through its community and feedback channels. Users should register passkeys in their GitLab authentication settings, ideally across multiple trusted devices or security keys for both stronger protection and account recovery.

multi-factor-authenticationgitlabdevsecopssecurity+4

figmaOct 12, 2022

Our approach to security at speed | Figma Blog (opens in new tab)

Figma’s security team aims to help teams ship quickly without compromising safety. Its approach combines early risk assessment, reusable technical controls, decentralized decision-making, and transparent collaboration rather than rigid mandates. The goal is to make security an enabler of product development. ## Systematically Assessing Risk - Security reviews upcoming features and workflows to identify risks early. - Teams use a three-question “ThreatJam” survey before security office hours, held three times weekly. - For FigJam’s rich link previews, the team identified risks including: - **SSRF**, where attackers could request internal Figma resources. - **Denial-of-service attacks** against linked websites. - Malicious HTML that could deface or execute code within FigJam. - Figma isolated link scraping and parsing in a cloud function running on a separate virtual machine and network. - Additional protections included: - Cloud-function rate limiting. - Temporary storage of scraped data. - Restricting requests to standard HTTP and HTTPS ports. - Limiting parsed HTML to approved tags. - Reusing existing plugin and widget security mechanisms. ## Reusable and Decentralized Security Solutions - Security provides customized guidance while avoiding centralized approval processes. - The team builds reusable libraries, frameworks, documentation, and security patterns. - Solutions developed for one product can serve as case studies for other engineering teams. - Office-hours notes are shared across Figma so teams can understand security reasoning and apply it independently. - This model allows security practices to scale as the company grows. ## Defending Against Phishing and Information Disclosure - Figma uses technical controls to protect employees, devices, and internal data. - Access to internal sites requires a passwordless second factor scoped to the specific site. - New employees receive hardware authenticator keys. - Employees are also encouraged to register biometric authenticators such as Touch ID or Windows Hello. Figma’s model demonstrates that security can move at development speed when teams assess threats early, isolate risky functionality, automate defenses, and share solutions broadly. Companies seeking a similar approach should prioritize reusable controls and security collaboration over process-heavy gates.

multi-factor-authenticationcloud-nativeweb-securitydenial-of-service+3