Passwords suck. Can passkeys replace them?
Summary
Discusses the potential of passkeys to replace passwords as a more secure authentication method.
Similar Articles
XSS Is Deadly for Passkeys: The Hidden Risk of Attestation None
The article explains how a single XSS vulnerability can defeat the phishing-resistance of passkeys when attestation is set to 'none', allowing attackers to register their own passkeys and achieve persistent account takeover. It calls for attention to this overlooked threat and suggests defenses.
Passkeys were invented by engineers with zero understanding of consumer brain
The author criticizes the rollout of passkeys, arguing that they were designed by engineers who don't understand how ordinary consumers think, and expresses confusion even as a tech company founder.
Anonymous credentials: an illustrated primer (Part 2)
Second part of an illustrated primer explaining real-world anonymous credential systems like Privacy Pass and Google's age-verification proposal, focusing on preventing credential cloning and enabling expressive proofs without sacrificing user privacy.
Preventing token theft
The article discusses the problem of authentication token theft by infostealer malware and explores a 15-year-old proposal by Dirk Balfanz to use self-signed client certificates for TLS mutual authentication to bind tokens to a specific device, preventing token reuse even if stolen.
plass: manage passwords
plass is a minimalistic, UNIX-philosophy-inspired password manager written in C that uses GPG for encryption and got for version control.