andres

I’ve been at Auth0 since 2017. I’m currently working as a Director, Product Management for the Auth0 FGA and OpenFGA products. Previously, I worked in the teams that owned the Login and MFA flows. <br>
I spent my entire 20+ year career building tools for developers, wearing different hats. When I'm not doing that, I enjoy spending time with my family, singing in a choir, cooking, or trying new kinds of local cheese.

Director, Product Management

Andrés Aguiar

Join us at KubeCon + CloudNativeCon Europe on April 17th, 2023, for the official launch of OpenFGA v1.0

We’ve been talking to hundreds of developers who consistently tell us that they want to change how authorization is implemented in their applications. Authorization logic is embedded in the code and implemented differently in each service. It’s not flexible enough to define complex policies or finer-grained authorization. They struggle with load at scale. The existing RBAC/ABAC solutions can’t handle this complexity. That’s why we built OpenFGA.

We are thrilled to announce the release of [OpenFGA](https://openfga.dev) v1.0, a modern, flexible authorization system inspired by [Google's Zanzibar](https://zanzibar.academy). OpenFGA, designed for reliability and low latency at scale, has been embraced by the developer community since its open-sourcing in June 2022. As a Cloud Native Computing Foundation (CNCF) Sandbox Project, OpenFGA is having a significant impact in the world of authorization.

## OpenFGA v1.0: A Host of Enhancements

OpenFGA v1.0 brings a wealth of improvements since it was open sourced, raising the bar for authorization systems and providing developers with the tools they need to create secure, scalable applications. Here's a rundown of the new features:

1. Enhanced Authorization Model Language: OpenFGA v1.0 offers a [significantly improved](https://openfga.dev/docs/modeling/migrating/migrating-schema-1-1) language for defining authorization models, making them easier to read and author.
2. ListObjects API: This [new API](https://openfga.dev/docs/interacting/relationship-queries#listobjects) lets you retrieve all resources that a user can access based on the defined authorization policies, greatly simplifying auditing and access controls.
3. Elevated Observability: OpenFGA v1.0 takes [observability to new heights](https://openfga.dev/docs/getting-started/setup-openfga/docker#telemetry) with Open Telemetry tracing, Prometheus metrics, and prof profiles, providing insights into your authorization system's performance.
4. Effortless Deployment: Deploying OpenFGA to Kubernetes has never been easier, thanks to [official Helm chart](https://artifacthub.io/packages/helm/openfga/openfga) support. Get your Kubernetes cluster provisioned with just one command.
5. Postgres Storage Adapter Performance Boost: OpenFGA v1.0's Postgres storage adapter is supercharged, ensuring rapid performance and seamless scalability.
6. New Python SDK: A brand-new [Python SDK](https://pypi.org/project/openfga-sdk/) makes it even more convenient for Python developers to integrate OpenFGA into their projects.
7. Batching support in SDKs: OpenFGA v1.0's enhanced SDKs support batching queries, providing greater efficiency when making authorization requests, available for [JavaScript](https://github.com/openfga/js-sdk#batch-check) and [.NET](https://github.com/openfga/dotnet-sdk), [Go](https://github.com/openfga/go-sdk) coming pretty soon!

## Experience OpenFGA v1.0 at KubeCon + CloudNativeCon Europe, April 17, 2023

Mark your calendars and join us at KubeCon + CloudNativeCon Europe for the official launch of OpenFGA v1.0. Be among the first to discover the future of authorization systems and learn how OpenFGA can transform your cloud deployments and bolster your application security.

You’ll be able to connect with the OpenFGA team in different ways:

* Find us at Kiosk #27 in the Project Pavilion in the afternoons.
* Join the [OpenFGA project meeting](https://kccnceu2023.sched.com/event/1JWSb) on April 18, 9:30 AM CST in Room D406, Congress Center
* Participate in the Cloud Native Authorization Birds of a Feather meeting on April 21st from 11 AM - 12:30 PM CST. You can register [here](https://kccnceu2023.sched.com/event/1KW9e).

## Join us!

An open-source project is only as good as its community, so we are extending a warm welcome to everyone who wants to get involved. 

The project already has more than 30 contributors from multiple companies, and it’s being deployed in production by many of them.

The community has contributed a [MySQL Storage Adapter](https://github.com/openfga/openfga/pull/210), SDKs for [ASP.NET Core](https://github.com/Hawxy/Fga.Net), [Elixir](https://github.com/msutkowski/fga-elixir-sdk),  [Kotlin](https://github.com/Ozee-io/fga-kotlin-sdk) and integrations with [Quarkus](https://github.com/quarkiverse/quarkus-zanzibar), [Open Policy Agent](https://github.com/thomasdarimont/custom-opa-openfga), [Keycloak](https://github.com/embesozzi/keycloak-openfga-workshop), [Kratos](https://github.com/tx7do/kratos-authz) and [SCIM](https://github.com/SUSE-Skyscraper/openfga-scim-bridge).

You can help by simply trying the product, providing feedback, and engaging with other OpenFGA users in [Discord](https://discord.gg/6xzMMuU8YR) / [Github Discussions](https://github.com/orgs/openfga/discussions), attending our [monthly meetings](https://github.com/openfga/community/blob/main/community-meetings.md), or [contributing](https://github.com/openfga/.github/blob/main/CONTRIBUTING.md) to the project.

Find out more by checking out the Github repository [https://github.com/openfga/openfga](https://github.com/openfga/openfga), and learn how to use it in our [documentation](http://openfga.dev). Keep up to date with the latest news by following us on [Twitter](https://twitter.com/openfga).


Announcing OpenFGA v1.0: A New Milestone in Cloud Native Authorization Systems

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Auth0 integrates netID to support customer privacy needs in Europe

**London/Montabaur, Germany – August 17, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, and the [European netID Foundation](https://enid.foundation/en/) today announced the availability of netID Single Sign-On on [Auth0 Marketplace](https://marketplace.auth0.com/), a catalog of trusted technology integrations to extend the functionality of Auth0’s identity management platform. 

[netID](https://marketplace.auth0.com/integrations/netid-single-sign-on) enables users to sign into apps and websites with their netID account and to decide privately and transparently which data to share. As an independent European identity provider with more than 38 million active user accounts in Germany, netID provides the necessary infrastructure for [Single Sign-On (SSO)](https://auth0.com/blog/what-is-single-sign-on-a-non-developer-s-guide/) but does not store any user data itself. Users can manage the consents they’ve given at any time in netID’s Privacy Center.

“Whether in finance, e-commerce, or online publishing, engaging with users in an all trusted and transparent way is key to driving success. We are excited about the partnership with Auth0 and the availability of the netID Single Sign-On integration. Joint customers can now seamlessly integrate our product and offer users a European alternative to U.S. social login providers,” says Achim Schlosser, board member, and chief technology officer of the European netID Foundation.

“After speaking with many customers, we have identified the integrations that matter to them. The availability of netID on [Auth0 Marketplace](https://marketplace.auth0.com/) is a direct response to the growing need for privacy-enhancing technologies in Europe and part of our continued commitment to international markets,” said Cassio Sampaio, SVP of Product at Auth0. “We are thrilled to have netID as a vetted and valuable vendor in Auth0 Marketplace.” 

Auth0 reviews partner integration functionality and makes available integrations that are easy to discover and integrate for customers. Partners can participate in the growing demand for digital identity solutions and increase their visibility as part of the Auth0 Marketplace and can learn more here: [https://auth0.com/partners](https://auth0.com/partners).

[Auth0, recently acquired by Okta](https://auth0.com/blog/okta-acquisition-announcement/), provides a modern identity platform that helps organizations meet the security, privacy, and convenience needs of their users. Please visit [Auth0 Identity Platform](https://auth0.com/identity-platform) to learn more.

## About the European netID Foundation

The European netID Foundation was established in March 2018 by Mediengruppe RTL Deutschland, ProSiebenSat.1, and United Internet with its brands WEB.DE and GMX. With an independent market solution, the foundation supports Internet offerings from all industry sectors with the implementation of the new European data protection law and, for this purpose, has created the open login standard netID. The initiators of the foundation together reach around 50 million unique users every month and together have more than 38 million active accounts. The foundation is explicitly open to additional partners and initiatives. Further information is available at [www.enid.eu](https://enid.foundation).

<include src="asides/AboutAuth0" />

### Media Contacts
Alexandra Roszkowski<br />
[presse@enid.eu](mailto:presse@enid.eu) <br />
+49 162 25 27-188<br />

Sarah Konarski & Nele Mascher<br />
Finn Partners for Auth0, DACH<br />
[auth0de@finnpartners.com](mailto:auth0de@finnpartners.com)<br />

Auth0 Marketplace Now Offers netID Solution

Lucy McGrath

Lucy is VP, Privacy at Auth0. She's a lawyer and global data privacy expert with diverse experience working with some of the world's leading media and technology companies. As Auth0’s VP, Privacy, she leads global data privacy strategy and is driven by a passion for further embedding privacy-by-design and continuing to shape our culture of privacy that starts with finding the humans that we impact every day.

VP, Privacy

Auth0 is preparing new documentation for its customers with European users.

At Auth0, our continuing mission is to secure the world’s identities so innovators can innovate. The core to delivering this mission is trust, including Auth0’s commitment to security and privacy.  

Auth0 welcomes the new Standard Contractual Clauses (“new SCCs”) issued by the European Commission, and is happy to see that they reflect a broader set of transfer scenarios and the European Court of Justice’s (ECJ) decision in the Schrems II case last year. 

As required by the European Commission’s decision, Auth0 will begin using the new SCCs for new customers on or before September 27, 2021 (with a goal of late July / early August). Once we have a generally available version of a new Data Processing Addendum (DPA) that incorporates the new SCCs, we will also be able to make this available to existing customers.

Once we have had an opportunity to consider final guidance on the new SCCs to be provided by the European Data Protection Board, we will update this post to summarize the transition program, including issues such as:

* Whether we anticipate making changes to our form of Subscription Agreement
* What changes we will be making to our DPA (“new DPA”)
* How existing customers will be able to transition to the new DPA and new SCCs 

During this transition period, we will continue to adhere to existing contractual obligations set out in the existing Standard Contractual Clauses (“old SCCs”) that are available [here](https://auth0.com/legal).

Lucy McGrath
VP, Privacy, and Data Protection Officer
Auth0, Inc 

Auth0 Statement on New Standard Contractual Clauses issued by European Commission

auziros:mckenzie-mayer

Customer Identity (CIAM) Product Comms lead, driving collective storytelling across Okta and Auth0. Making technology accessible for everyone.

Customer Identity Product Comms Lead at Okta

McKenzie Mayer

Leading media companies choose Auth0 to authenticate and monetise digital subscribers



LONDON  ** June 3, 2019 ** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced rapid customer growth in Northern Europe. In the last year alone, Auth0 has tripled its customer base in the region, signing on well-known enterprises Elsevier and Atea Norge; as well as prominent media leaders, such as TV 2 Danmark, broadcaster of the Danish "X-Factor" show; Danish Broadcasting Corporation; and Alma Media.

Northern Europe boasts the EU's [top five most advanced digital economies](https://ec.europa.eu/digital-single-market/en/desi), and the Nordic countries lead the world in [paying for online news](http://media.digitalnewsreport.org/wp-content/uploads/2018/06/digital-news-report-2018.pdf?x89475) through subscription, membership, donations, or per-article payments, according to Reuters. The digitisation of the media industry in the region has created an urgent need for identity management, as media companies seek to reduce friction for their users to sign up and access content, and turn free users into subscribers.

"What if an extra 10 percent of visitors to your app or online publication decided to spend money with you? Identity makes this possible, giving companies the tools to streamline their login, collect first-party data, and personalise experiences for their customers, which drive additional revenue opportunities," said Steven Rees-Pullman, GM of EMEA at Auth0. "Northern European companies understand this value, and turn to Auth0 for a modern identity platform and a roadmap for getting started."

Danish Broadcasting Corporation (DR), Denmark's largest media company and producer of a broad variety of Danish content, uses Auth0 to authenticate users of their various video, audio, and live voting apps. Auth0 supported both the implementation and assisted DR in mapping out an identity strategy for the near-and far-term.

For more on how Auth0 supports the media sector, including a case study with [Finland-based Alma Media](https://auth0.com/learn/alma-media-sees-30-total-savings-seamless-brand-access/), please visit: <https://auth0.com/media-publishing/>.

<include src="asides/AboutAuth0" />

### Media Contacts:

Mark Fowler<br/>
Racepoint Global for Auth0, EMEA<br/>
(auth0@racepointglobal.com)[mailto:auth0@racepointglobal.com]<br/>
+44 (0) 77 1124 4113


Auth0 Expands European Presence with Customers in Benelux and the Nordics

The Economist honoured for Best Identity Platform Project



LONDON  **May 16, 2019** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced that one of its valued customers, The Economist Group, has won the [2019 European Identity & Cloud Award](https://www.kuppingercole.com/events/eic2019/award) in the inaugural Best Identity Platform Project category.

![The Economist Group won the 2019 European Identity & Cloud Award](https://images.ctfassets.net/23aumh6u8s0i/2GU6aaiw4v1NhpTJlIfyhY/a9b0d379124eff5681c67b2a38fe9ede/the-economist-wins-2019-kuppingercole-european-identity-and-cloud-award_best-identity-platform-auth0-economist)

The prestigious award from global analyst firm, KuppingerCole Analysts AG recognises outstanding identity management and cloud computing projects. The Economist was selected by KuppingerCole analysts for their deployment of Auth0 to provide secure, one-click login across their online platforms, and better understand the relationship between their users and the publication.

Andrew Williams, Chief Digital Officer at The Economist said "It is an enormous honour to have been given this award. Identity management is a major step on our journey to ensure that our digital solutions match the excellence of our journalism, hence to have our achievements recognised in this way is a great validation that we are on the correct course."

The Economist have traditionally hand-crafted and built all their digital services themselves. Upon recognising the need to outsource identity management and focus on innovation, they choose Auth0. Using Auth0's Universal Identity Platform, The Economist supports up to two million active consumers, and will soon extend the same, seamless access to universities, corporations, and nonprofits that offer subscriptions to the publication as part of their benefits packages.

"The Economist took a leap of faith in asking Auth0 for help, at a time when media companies were under immense pressure to do things differently. That risk has paid off," said Steven Rees-Pullman, GM of EMEA at Auth0. "The Economist is not only surviving in the digital world, but has leapfrogged the competition. We are proud to support them in making the transition from print to digital easier for their readers worldwide and congratulate them on this honour."

Winners were celebrated at an award ceremony on Wednesday, May 15, 2019 during the European Identity & Cloud Conference (EIC) in Munich, Germany. See the full list of winners [here](https://www.kuppingercole.com/20190516_eic_awards_2019). 

## About The Economist Group

The Economist Group is built on high-quality, independent analysis which runs through all of its businesses. Based in London and serving a global readership and client base, the group publishes print and digital products, produces global events, and offers a range of subscription and other services for clients and readers. Its flagship businesses include The Economist newspaper, and research and analysis division The Economist Intelligence Unit.

<include src="asides/AboutAuth0" />

### Media Contacts:

Mark Fowler<br/>
Racepoint Global for Auth0, EMEA<br/>
[auth0@racepointglobal.com](mailto:auth0@racepointglobal.com)<br/>
+44 (0) 77 1124 4113

Lauren Hackett<br/>
The Economist Group<br/>
[laurenhackett@economist.com](mailto:laurenhackett@economist.com)<br/>


The Economist Wins 2019 KuppingerCole European Identity & Cloud Award

krti_XnE_400x400

At Auth0 we ❤️ developers. Serving & giving back to the community is one of the most rewarding things we do. We want to empower others to join the mission!

Auth0 Ambassador

ngVikings brought the European Angular communities to Espoo, Finland for two days of networking and learning.



A big part of being an [Auth0 Ambassador](https://auth0.com/ambassador-program) and Evangelist is attending and speaking at conferences all over the world. Our ambassadors attend a very diverse set of events ranging from technology-specific conferences, like [Oracle Code](https://developer.oracle.com/code), to technology agnostic conferences like [CodeMash](http://www.codemash.org/), and everything in between.

The **Conference Recap** series will summarize our experiences at the various conferences we attend, sharing the big news, things we learned, things we liked, and more. We’ll kick the series off with [ngVikings](https://ngvikings.org/).

<AmpContent>

[Watch "ngVikings 2018 &mdash; Highlights"](https://www.youtube.com/watch?v=-wVodWS-9OU)


</AmpContent>

<NonAmpContent>


<iframe width="560" height="315" src="https://www.youtube.com/embed/-wVodWS-9OU" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>


</NonAmpContent>

## ngVikings 2018

![ngVikings Venue](https://images.ctfassets.net/23aumh6u8s0i/39jPAKVqu8vOejBL7XQTh2/b36446505b50304cdbb11d97532c8903/ng-vikings-2018-stage)

Dubbed as the "main Angular event in the Nordics — and the only traveling Angular conference in the world", ngVikings was a unique two-day conference organized by a coalition of Angular and GDG Meetups from the Nordic countries of Norway, Sweden, Finland, and Denmark. This year, the traveling conference was scheduled to be in Helsinki but found itself in close-by Espoo, Finland and was held at [Aalto University](http://www.aalto.fi/en/).

The conference brought together over 300 developers and speakers from all over the world.

The keynote address was delivered by a core member of the Angular team [Matias Niemelä](https://twitter.com/yearofmoo/) and focused on his journey to Angular, how Angular has evolved over the last five years, and where it’s headed next. [Angular Elements](https://github.com/angular/angular/issues/20891) and the new ngIvy renderer seem really promising additions to the already excellent framework. Watch the keynote here:

<AmpContent>
<amp-youtube
    data-videoid="WahpV6zn8lQ"
    layout="responsive"
    width="480" height="270">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/WahpV6zn8lQ" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

After the keynote, the conference was split into two tracks with each speaker giving a 30-minute presentation. The talks featured at ngVikings focused mainly on Angular 2+ showing best practices, sharing lessons learned, and focusing on the future of the framework. You can view all of the talks [here](https://www.youtube.com/watch?v=WahpV6zn8lQ&index=1&list=PLVI0Ut22uwY4UC1v5fUvi2RIU4R4jPkba), and while all of the talks were great and worth checking out, a few that really stood out for me where:

### Deploying Angular and Node to the Cloud

<AmpContent>
<amp-youtube
    data-videoid="XmpEZN5TCjw"
    layout="responsive"
    width="480" height="270">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/XmpEZN5TCjw" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

by [John Papa](https://twitter.com/John_Papa)

> Your Angular app is complete! Now it's time to deploy it to the cloud. But how? One key ingredient is determining our goals. Do you want to publish directly from your laptop or through source control and CI/CD? Do you worry that it may work differently on your machine than the cloud? What about locking down versions of node, packages, and OS? Is your head about to explode? We'll explore several good options as we discuss the pros and cons of each including direct deployments, GitHub hooks with CI, and docker. We'll demonstrate how to code, debug, and run docker locally to have confidence that what works locally will work in the cloud. The good news is that tooling has improved to make all of these deployment options within your reach to guide you to successfully deploy your Angular app to the cloud.

### Advanced Angular DI

<AmpContent>
<amp-youtube
    data-videoid="PRRgo6F0cjs"
    layout="responsive"
    width="480" height="270">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/PRRgo6F0cjs" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

by [Ward Bell](https://twitter.com/wardbell?lang=en)

> You Don’t Know DI? Go beyond Dependency Injection basics. Learn about the two parallel DI hierarchies and which one wins, what happens when you provide the same token twice … when multi is true, what’s the effect of lazy loading, what’s going on in forRoot and forFeature, what’s in a component’s injector, and how to talk to the components in content children when you don’t know their types. It’ll be fast, code-frontal, fun.

### 6 Apps One Codebase with Ionic

<AmpContent>
<amp-youtube
    data-videoid="4bGMXuPM_FI"
    layout="responsive"
    width="480" height="270">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/4bGMXuPM_FI" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

by [Sani Yusuf](https://twitter.com/saniyusuf)

> You and your team have this great Idea and you have your users using different devices and operating systems to access the same application. Some users are on the Web, some on Mobile some of their Desktop and you also have to worry about what operating system they are on and also have to consider how your application is presented on each device & operating system. What if there was a way to code your app without worrying too much about operating systems/devices/screen sizes and just focusing on getting your idea across to your users regardless. Join me on a journey where I show you how to use Angular, Ionic & the PWA standard to build apps for IOS, Android, Windows, Web, Mac & PC with the same code all using just HTML5.

A big shout out to the organizers including [Maxim Salnikov](https://twitter.com/webmaxru), [Shahrzad (Sherry) Aziminia](https://twitter.com/sherrrylst), [Chris Noring](https://twitter.com/chris_noring), [Jussi Kinnula](https://twitter.com/jussikinnula), and the [rest of the team](https://2018.ngvikings.org/team/) for putting together such a great conference.

## Auth0 at ngVikings 2018

[Ado Kukic](https://ado.xyz), Developer Evangelist at Auth0, was the only Auth0 representative at ngVikings and gave a talk titled “A Token Walks Into a SPA…”, which focused on token-based authentication for single page applications and Angular in specific. You can watch the talk here:

<AmpContent>
<amp-youtube
    data-videoid="EoEOjQhSHNo"
    layout="responsive"
    width="480" height="270">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/EoEOjQhSHNo" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

The talk covered topics ranging from why you should consider token-based authentication, how JSON Web Tokens actually work, SPA architectures and security considerations they bring with them, and finally how to incorporate token based authentication using various Angular specific features like HTTP Interceptors, Route Guards, and more.

## ngVikings 2019

I am very hopeful that ngVikings makes a return next year, and the official conference website implies it will. Check out the [official site](https://ngvikings.org/) for updates on where the traveling conference is sailing to next!

![Over 300 developers attended ngVikings](https://images.ctfassets.net/23aumh6u8s0i/5ysl15Y4PNwYquLgpU7r3E/0a5ed58058f87f7c08effe5b1057022a/attendees)

If you are interested in learning more about or joining the Auth0 Ambassador program, check out the [Ambassador page on our website](https://auth0.com/ambassador-program).

<include src="asides/AboutAuth0" />


Conference Recap: ngVikings 2018

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

A new global ransomware attack is affecting European countries and governments



In May, a ransomware called [WannaCry](https://auth0.com/blog/a-massive-ransomware-attack-targets-organizations-around-the-globe/) became famous around the world for holding computers' file systems as hostages. Today, government institutions (like [Ukraine's national bank](http://www.independent.co.uk/news/world/americas/petya-cyber-attack-us-pharma-merck-ukraine-ransomware-national-bank-power-wpp-ad-agency-wannacry-nhs-a7810906.html)) and companies from the private sector reported that another outbreak has started.

The ransomware responsible for haunting organizations today is called Petya, although this name originates from a [ransomware that attacked last year](https://blog.kaspersky.com/petya-ransomware/11715/). Similarly to WannyCry, today's Petya ransomware starts by encrypting a computers file systems and then it demands payments to restore access to these files.

## What Is a Ransomware?

The very definition of ransomware is a malware that blocks access to the victim's data until a ransom is paid. There are some ransomwares that lock the systems in a way that is not difficult to reverse, but the more advanced ones are using a technique called [cryptoviral extortion](https://en.wikipedia.org/wiki/Cryptoviral_extortion). This technique consists of encrypting victims files, makes them inaccessible. To regain access, the authors demand a ransom payment to reverse the encryption. Nowadays, most ransomwares are requesting [Bitcoins](https://bitcoin.org/) as ransom payment, to [take advantage of cryptocurrency's anonymity](https://bitcoinmagazine.com/articles/is-bitcoin-anonymous-a-complete-beginner-s-guide-1447875283/).

## What Is Petya Ransomware?

The real name of the ransomware that is striking today has not been defined. But, as this ransomware is supposed to be a variant of [Petya](https://blog.kaspersky.com/petya-ransomware/11715/), the name is being reused. Petya locks a computers hard drive as well as individual files stored on it. It's not easy to recover data from the computers affected by this malware.

One interesting fact is that cyber security experts at Kaspersky Lab have released a report that said the ransomware was not related to Petya but was in fact a new ransomware it called [NotPetya](https://www.forbes.com/sites/thomasbrewster/2017/06/27/petya-notpetya-ransomware-is-more-powerful-than-wannacry/#16c86cff532e). The contradictions are yet to be clarified.

![NotPetya/Petya screenshot](https://images.ctfassets.net/23aumh6u8s0i/3YZyJ4v23esutsMRvDiiqf/04e819bd692dafe953ca066274fdfcf9/notpetya)

## How Petya Started?

[A Ukrainian software firm is alleged to be the source of today's outbreak](https://www.forbes.com/sites/thomasbrewster/2017/06/27/medoc-firm-blamed-for-ransomware-outbreak/#20ca49ae73c8). Although there is no confirmation about this, and that the company has denied these claims in a [Facebook post](https://www.facebook.com/medoc.ua/posts/1904044929883085), the outbreak is indeed striking Ukraine harder then any country.

![Petya/NotPetya attacks by country](https://images.ctfassets.net/23aumh6u8s0i/79338Jos1R3YU6mfYS64kT/dff234a5379b9d3a8e5cb66c029a5c72/by-country)

## How The Petya Ransomware Spreads?

Researchers are saying that the this new outbreak is hitting systems via the same leaked NSA vulnerabilities used by [WannaCry](https://auth0.com/blog/a-massive-ransomware-attack-targets-organizations-around-the-globe/). The analysis of some of Petya's samples confirmed that the malware author used the [EternalBlue exploits](https://en.wikipedia.org/wiki/EternalBlue), which targeted a vulnerability in Microsoft Windows. [Microsoft already created patches to solve EternalBlue vulnerability](https://www.theverge.com/2017/4/15/15311846/microsoft-windows-shadow-brokers-nsa-hacks-patched), but many computers out there don't have this patch applied.

## How Do I Protect Myself?

Although no solutions were found for retrieving data from computers affected by Petya so far, you can review and [update your devices](https://www.theverge.com/2017/4/15/15311846/microsoft-windows-shadow-brokers-nsa-hacks-patched) and also check that your approach to security is good. Recently we wrote a blog post that shares some good practices regarding [Personal Information Security Guide for Family and Friends](https://auth0.com/blog/personal-information-security-identity-guide/).

Be sure to check out this [guide](https://auth0.com/blog/personal-information-security-identity-guide/) to learn how to secure your wireless network, backup your data so that it is not lost if you become a victim of ransomware such as WannaCry, detect phishing scams, and more.

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.


Global Ransomware Strikes Again

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

The new body of rules promises to tighten up data security for consumers in Europe.



We are happy to announce that effective today Auth0 is part of the EU-US Privacy Shield Program and publicly committed to comply with its requirements.
This certification enables Auth0 to transfer personal data from the European Union to the United States while complying with EU data protection requirements.

## Understanding Privacy Shield

The European Commission decided last year that the [Safe Harbor Principles](https://auth0.com/blog/safe-harbor-still-matters/), which outlined rules for the security of data transferred between the United States and EU by companies, were no longer robust enough. So they replaced Safe Harbor with the [EU-US Privacy Shield Framework](https://www.privacyshield.gov/welcome).

The Shield isn't a law, it's a system of rules that companies can comply with and get certification for. Therefore it's not a government mandate, but companies that comply will be authorized to transfer personal data from the EU to the U.S. 

This new body of rules promises more stringent protection of data and more oversight for those companies transferring data across the Atlantic.

## What's The Difference Between Safe Harbor And The Privacy Shield

The new EU Privacy Shield was agreed on in August this year with the intention of patching up the holes in Safe Harbor but also upgrading the security that American companies had to ensure.

The Shield is different from Safe Harbor mostly because it calls for the US Department of Commerce to play a larger role in monitoring and supervising compliance, including carrying out reviews and investigations of companies that participate. The Shield is pushing data legislation above and beyond Safe Harbor:

* Participating US companies are now required to post detailed privacy policies on their sites.
* US companies must allow EU citizens to opt out of data sharing with third parties.
* US companies can only process data that is “relevant” to the reason it was collected and must delete personal data that is no longer being used for the purposes it was collected for.
* EU citizens can file complaints via multiple avenues, more than under Safe Harbor.
* If a US company is found in violation by the Fair Trade Commission it has to publish the nature of its non-compliance.
* Even if they withdraw from The Shield, US companies might still have to comply with certain obligations.

Like Safe Harbor, American companies have to self-comply with the Privacy Shield. Doing so allows them to receive certification that their data transferral to the EU is secure. Auth0 is in the process of complying with the brand new EU-US Privacy Shield Framework. 

Auth0 follows the rules laid out in The Shield. In our [privacy policy](https://auth0.com/privacy) we demonstrate how discerning we are with data collection—we only ask for personal information we need to deliver our services and to ensure our site is running properly. We may also analyze your data through aggregated data pools, so that no individual is highlighted in our studies. This protects the privacy of our users.

## Why Was The Shield Introduced

With the constant business that flows between the European Union and the United States, sensitive data is moving back and forth across the two unions continuously. The goal with both Safe Harbor and the new EU Privacy Shield is to protect the data of [individual European consumers](https://medium.com/@nichchung/eu-u-s-privacy-shield-how-snowden-and-schrems-led-the-eu-to-armor-up-94207ee96702#.248ekl938). 

Safe Harbor was implemented in 2000. It was established after Google was launched and before Facebook came on the scene. Despite the fact that it was born before the internet looked anything close to what it does today, Safe Harbor wasn't updated until recently.

![A brief safe harbor history](https://images.ctfassets.net/23aumh6u8s0i/7iEDm5ew1NOoSfcwn214xN/0a5d48a52c242229249da431472d1d6b/safe-harbor-history)

*Source: [iapp](https://iapp.org/resources/article/a-brief-history-of-safe-harbor/)*

Safe Harbor was overturned after Edward Snowden demonstrated how the [NSA was collecting and tracking data](http://www.wired.com/2015/10/tech-companies-can-blame-snowden-data-privacy-decision/). These revelations were compounded by Max Schrems, an Austrian law student who [brought a complaint to the European Court of Justice](http://www.businessinsider.com/ecj-safe-harbor-ruling-bots-expected-2015-10) about Facebook's data collection. He asked the Irish Data Protection Commissioner to stop allowing Facebook, an American company, to transfer data from EU citizens to America. 

It soon became clear to EU citizens that their data could also be mined by the American government body without the consent of EU citizens.

After that one-two punch from Snowden and then Schrems, the European Commission was determined to create a new body of rules that would improve on Safe Harbor and make it even more transparent. And so the EU-US Privacy Shield Framework cracks down on insecure data collection and increases government oversight. 

## What Do I Have To Do To Join The Shield

The Privacy Shield requires self-compliance. That means there's no law demanding that you follow the rules set out by Shield, rather your company can opt to do so and receive certification. In complying with The Shield, organizations will be authorized to transfer the personal data of EU residents to the U.S. 

There are four requirements to joining Shield:

1. The company must be under the authority of the FTC or another U.S. agency (i.e. should be an American company or doing business in America) so these groups can ensure compliance
2. The company must make public its commitment to follow the rules laid out in Shield
3. The company must publicly post its privacy policy
4. The company must implement the Principles laid out in Shield

Any company that wants to be certified by the Department of Commerce for Shield must give them a very detailed description of how the company will be using the personal data of EU citizens. The certificate has to be renewed annually.

Auth0 is now part of the EU-US Privacy Shield Program and we are [already SOC 2 Type II certified](https://auth0.com/security). We also conform to the OpenID Connect protocol and offer HIPAA BAA agreements for companies transferring sensitive personal health information.

We follow a series of verified identity standards and have built our services around them, including LDAP, SAML, OAuth, and JSON Web Tokens. We also maintain the integrity of the data we collect and ensure [security](https://auth0.com/security) through encryption and password hashing. With Auth0 you can ensure up to five levels of password complexity and even opt into custom rules that implement the [OWASP recommendations](https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Implement_Proper_Password_Strength_Controls). Through Auth0 you can harness these powerful standards to protect your own applications. When we receive Shield-certification, that too will be available.

## The Future Of Data Protection

As soon as Shield landed on August 1, companies like [Microsoft](https://blogs.microsoft.com/eupolicy/2016/08/01/microsoft-signs-up-for-privacy-shield/) and [Workday](http://blogs.workday.com/workday-self-certified-on-day-one-of-privacy-shield/) were already signed up. But Shield is just the beginning for the new generation of data legislation in the EU. 

The EU-US Privacy Shield Framework promises to improve on current data collection practices and companies that get certified within it are signaling to their consumers that they value privacy and data protection. In 2018, data legislation within the EU is scheduled to expand again with the [General Data Protection Regulation](https://en.wikipedia.org/wiki/General_Data_Protection_Regulation). Shield is almost a primer for the new Regulation.

Data flow should always be secure no matter where in the world you're located. We are stringent in ensuring all the data we're trusted with remains protected. The EU-US Privacy Shield Framework will make sure that American companies are responsible for all the data they collect so consumers remain safe.


"europe"