Web authentication

A developer has written about how a password input tag using the maxlength attribute set to 20 prevented them from logging into Vanguard, the US investment firm. Longer passwords get silently truncated before submission, so authentication fails even though the user types the correct credentials. The piece argues the attribute is harmful in password fields and urges developers to avoid limiting password length, a pitfall other sites may share.

A cybersecurity commentator is asking whether the way the world authenticates to thousands of online services is sustainable, arguing that current login systems outpace the technical literacy of users across generations. The remark has struck a chord among information security professionals, who regularly point to passwords, phishing, and inconsistent security standards as growing problems. It feeds into a wider debate over passkeys, multi-factor authentication, and how to design account security that ordinary people can actually manage.

A new vulnerability, EUVD-2026-90892, has been recorded for the Apache HTTP Server, maintained by the Apache Software Foundation. The flaw involves missing authentication checks in the mod_auth_digest module in versions before 2.4.69, potentially allowing unauthenticated access. Users are advised to update to a patched release. The entry was updated on 1 October 2026.