your tumblr passwords are most likely safe (assuming you don't use the same password for other websites like twitter), but it can't hurt to change them now if you'd like.

How can refresh token rotation ensure that refresh tokens can be stored securely in single page web apps?

Some links for reference:

Why are Refresh Tokens considered insecure for an SPA? | SA

What is the purpose of a "Refresh Token"? | SA

What Are Refresh Tokens and How to Use Them Securely | auth0

Privacy has been a fantasy for quite some time. This is why my perspective boils down to: disguise is better than concealment. If we cannot stop the data from being collected, then we can corrupt it with a mountain of misinformation. This holds up online and offline – if you are going to go through the effort of learning how to sneak about, you should also be spending time leaning to be someone else. The value of video footage drops dramatically if the person they see in the recording isn’t the “real” you so to speak.

Responding to your comments on covid, we are (unfortunately) far beyond the point at which it could have been contained. Given it’s discovery in animal populations an ideal human quarantine situation still wouldn’t eliminate the virus. With this in mind there isn’t much of a “solution” to be had, at least not beyond the things we already do for the flu, etc.

What we are now confronted with is the application of covid as geopolitical leverage. Specifically in regards to who gets the vaccines, both in terms of geographical location and population demographics. Suffering damage from covid (on the national level) is less of a problem so long as your enemies / targets / competition suffer more.

As for the more personal level, the disabled and chronically ill are inevitably tossed to the gutters. Our lives and well being were never a consideration in the matter. As things move forward a substantial number of people will experience diminished health (due to long covid, etc) and while this is an obvious economic emergency – it is an emergency that (much like climate) can be pushed down the road.

A sophisticated new phishing kit smuggles itself past defenses inside your own browser, then walks victims through a convincing Microsoft 365 fake login — complete with CAPTCHA and multi-factor authentication prompts — to hand attackers full account control.

Source: Fortra FIRE

Europol, backed by Proofpoint and IBM X-Force, dismantled the StealC malware-as-a-service empire — seizing over 25.6 million stolen credentials, nuking 66 domains, and taking down 296 servers tied to a ransomware-delivering infostealer network.

Source: Proofpoint Threat Research Team