Passwordless wrist login. Never gets old
(except when the FIDO2-HID bridge breaks...)
(except when the FIDO2-HID bridge breaks...)
November 21, 2024 at 7:01 PM
Passwordless wrist login. Never gets old
(except when the FIDO2-HID bridge breaks...)
(except when the FIDO2-HID bridge breaks...)
This is motivated by the discussion in github.com/FiloSottile/ty… and the experiment in github.com/olastor/age-pl…, but it makes different UX and security choices: it's passkey-first FIDO2-second, and it is strongly hardware-bound (as in you need a FIDO2/WebAuthN op per file).
January 11, 2025 at 1:49 PM
This is motivated by the discussion in github.com/FiloSottile/ty… and the experiment in github.com/olastor/age-pl…, but it makes different UX and security choices: it's passkey-first FIDO2-second, and it is strongly hardware-bound (as in you need a FIDO2/WebAuthN op per file).
also if you really care you can buy a hardware fido2 token and never worry about this problem again
July 26, 2026 at 9:21 AM
also if you really care you can buy a hardware fido2 token and never worry about this problem again
It's a pity Apple doesn't add NFC on Macs.
I need to keep plugging in the FIDO2 security keys into the USB ports.
I need to keep plugging in the FIDO2 security keys into the USB ports.
February 9, 2025 at 11:51 AM
It's a pity Apple doesn't add NFC on Macs.
I need to keep plugging in the FIDO2 security keys into the USB ports.
I need to keep plugging in the FIDO2 security keys into the USB ports.
Today we fight against the FIDO2 spec
March 9, 2026 at 9:43 AM
Today we fight against the FIDO2 spec
If you don't like your body, you can just change it. God is fake and we live in an age of ascending transhumanism. Hack your endocrine system. Add or remove body parts. Store your PGP and FIDO2 keys under your skin. Give yourself new senses. Make yourself glow in the dark.
June 27, 2026 at 6:09 PM
If you don't like your body, you can just change it. God is fake and we live in an age of ascending transhumanism. Hack your endocrine system. Add or remove body parts. Store your PGP and FIDO2 keys under your skin. Give yourself new senses. Make yourself glow in the dark.
macOS SSH still doesn’t support FIDO2 are you kidding me
October 30, 2024 at 4:28 AM
macOS SSH still doesn’t support FIDO2 are you kidding me
Is this technically FIDO2?
August 20, 2025 at 1:54 PM
Is this technically FIDO2?
App passwords with guardrails
+
Delegate without sharing passwords
+
Get important alerts where you actually see them
+
2FA (WebAuthn/FIDO2, TOTP, backup codes, trusted devices)
Unreal
+
Delegate without sharing passwords
+
Get important alerts where you actually see them
+
2FA (WebAuthn/FIDO2, TOTP, backup codes, trusted devices)
Unreal
December 30, 2025 at 4:56 AM
App passwords with guardrails
+
Delegate without sharing passwords
+
Get important alerts where you actually see them
+
2FA (WebAuthn/FIDO2, TOTP, backup codes, trusted devices)
Unreal
+
Delegate without sharing passwords
+
Get important alerts where you actually see them
+
2FA (WebAuthn/FIDO2, TOTP, backup codes, trusted devices)
Unreal
OpenSSH 8.2+ supports FIDO2 sk-ssh-ed25519 keys. Private key stays on your YubiKey/SoloKey, signing via CTAP2. No key exfiltration. Setup guide: https://www.valtersit.com/vault/hardwarebacked-ssh-authentication-with-fido2-sksshed25519-ke-67a1d0/ #ssh #fido2 #yubikey
Hardware-Backed SSH Authentication with FIDO2 sk-ssh-ed25519 Keys
www.valtersit.com
September 25, 2026 at 2:00 AM
OpenSSH 8.2+ supports FIDO2 sk-ssh-ed25519 keys. Private key stays on your YubiKey/SoloKey, signing via CTAP2. No key exfiltration. Setup guide: https://www.valtersit.com/vault/hardwarebacked-ssh-authentication-with-fido2-sksshed25519-ke-67a1d0/ #ssh #fido2 #yubikey
I low key love that Apple allows you to add external fido2 keys to your Apple ID and won’t let you do it if you don’t have two keys, one for main and one for backup.
October 21, 2024 at 9:47 AM
I low key love that Apple allows you to add external fido2 keys to your Apple ID and won’t let you do it if you don’t have two keys, one for main and one for backup.
RDP Auth PSA: FIDO2 != smartcards. They use very different API layers, and they're not the same.
Smartcards: Kerberos with PKINIT and X.509 certificates, requires a KDC line-of-sight
FIDO2: doesn't use Kerberos, requires RDP RDS AAD auth and being joined to Entra ID
Smartcards: Kerberos with PKINIT and X.509 certificates, requires a KDC line-of-sight
FIDO2: doesn't use Kerberos, requires RDP RDS AAD auth and being joined to Entra ID
April 8, 2025 at 3:00 PM
RDP Auth PSA: FIDO2 != smartcards. They use very different API layers, and they're not the same.
Smartcards: Kerberos with PKINIT and X.509 certificates, requires a KDC line-of-sight
FIDO2: doesn't use Kerberos, requires RDP RDS AAD auth and being joined to Entra ID
Smartcards: Kerberos with PKINIT and X.509 certificates, requires a KDC line-of-sight
FIDO2: doesn't use Kerberos, requires RDP RDS AAD auth and being joined to Entra ID
Swift is now listed on the libraries section of @passkeys.dev! No excuse for anyone now! passkeys.dev/docs/tools-l...
Libraries
A list of libraries for passkeys and FIDO2/WebAuthn
passkeys.dev
April 9, 2025 at 11:19 AM
Swift is now listed on the libraries section of @passkeys.dev! No excuse for anyone now! passkeys.dev/docs/tools-l...
מי שקשר את מערכת ההזדהות הלאומית למספר טלפון צריך להיות מפוטר לאלתר.
זה לא עומד בשום סטנדרט אבטחה, זה מפלה עניים, זקנים ונכים, זה דורש טיפול מיוחד בהאצלת סמכות ומעל לכל זה מיותר.
מערכת מבוססת סטנדרטים קיימת, כמו TOTP, FIDO2 וכדומה היתה טובה יותר בכל אספקט אפשרי.
זה לא עומד בשום סטנדרט אבטחה, זה מפלה עניים, זקנים ונכים, זה דורש טיפול מיוחד בהאצלת סמכות ומעל לכל זה מיותר.
מערכת מבוססת סטנדרטים קיימת, כמו TOTP, FIDO2 וכדומה היתה טובה יותר בכל אספקט אפשרי.
מערכת ההזדהות הלאומית שלחה אתמול סמס נוזף שמספר הטלפון שלי משמש להזדהות עבור כמה חשבונות. מה שמערכת ההזדהות הלאומית לא לקחה בחשבון זה קשישים כמו אמא שלי שעוד לפני הדמנציה לא ממש הסתדרה עם כל הטכנולוגיות החדשות האלה. אז עכשיו אני אצטרך להחזיק עוד קו רק בשבילה וחוץ מפחות נוח לא הועלנו לפרטיות בשוםצורה
July 9, 2025 at 7:43 AM
מי שקשר את מערכת ההזדהות הלאומית למספר טלפון צריך להיות מפוטר לאלתר.
זה לא עומד בשום סטנדרט אבטחה, זה מפלה עניים, זקנים ונכים, זה דורש טיפול מיוחד בהאצלת סמכות ומעל לכל זה מיותר.
מערכת מבוססת סטנדרטים קיימת, כמו TOTP, FIDO2 וכדומה היתה טובה יותר בכל אספקט אפשרי.
זה לא עומד בשום סטנדרט אבטחה, זה מפלה עניים, זקנים ונכים, זה דורש טיפול מיוחד בהאצלת סמכות ומעל לכל זה מיותר.
מערכת מבוססת סטנדרטים קיימת, כמו TOTP, FIDO2 וכדומה היתה טובה יותר בכל אספקט אפשרי.
How to Implement Passkey in #ASPNETCore with Fido2-net-lib?
https://buff.ly/3Z0DoCU
#dotnet #webdev #security #passkeys #csharp #auth
https://buff.ly/3Z0DoCU
#dotnet #webdev #security #passkeys #csharp #auth
How to Implement Passkey in ASP.NET Core with Fido2-net-lib?
This blog explains how to secure your ASP.NET Core apps with Passkey authentication using Fido2-net-lib.
buff.ly
November 27, 2024 at 4:00 PM
How to Implement Passkey in #ASPNETCore with Fido2-net-lib?
https://buff.ly/3Z0DoCU
#dotnet #webdev #security #passkeys #csharp #auth
https://buff.ly/3Z0DoCU
#dotnet #webdev #security #passkeys #csharp #auth
I'm a big fan of FIDO2 and the push to embrace more modern ways of auth, so when I see research that defeats such mechanisms.
Defeating FIDO2/CTAP2/WebAuthn using browser in the middle and reflected cross site scripting
Defeating FIDO2/CTAP2/WebAuthn using browser in the middle and reflected cross site scripting
May 22, 2025 at 1:21 PM
I'm a big fan of FIDO2 and the push to embrace more modern ways of auth, so when I see research that defeats such mechanisms.
Defeating FIDO2/CTAP2/WebAuthn using browser in the middle and reflected cross site scripting
Defeating FIDO2/CTAP2/WebAuthn using browser in the middle and reflected cross site scripting
Looking at these two protocol flows from the FIDO2 UAF standard (the first registers a new device, the second authenticates using that device), what looks weird to you?
June 6, 2025 at 10:57 AM
Looking at these two protocol flows from the FIDO2 UAF standard (the first registers a new device, the second authenticates using that device), what looks weird to you?
Was able to get some good #powershell done this morning.. hoping to have a new release of EntraFIDOFinder tomorrow with some new features github.com/DevClate/Ent...
GitHub - DevClate/EntraFIDOFinder: PowerShell Module to find compatible FIDO2 keys for Entra
PowerShell Module to find compatible FIDO2 keys for Entra - DevClate/EntraFIDOFinder
github.com
December 1, 2024 at 4:09 PM
Was able to get some good #powershell done this morning.. hoping to have a new release of EntraFIDOFinder tomorrow with some new features github.com/DevClate/Ent...
"Protect your ASP.NET site using FIDO2 Passkeys" by kaeedo for #fsharp #FsAdvent hashset.dev/article/25_p...
Protect your ASP.NET site using FIDO2 Passkeys
Previously we've explore how to protect your ASP.NET site using Supabase Auth and then using Bitwarden's Passwordless service. Lets explore how to use Passkeys directly without relying on a third part...
hashset.dev
December 11, 2024 at 11:19 AM
"Protect your ASP.NET site using FIDO2 Passkeys" by kaeedo for #fsharp #FsAdvent hashset.dev/article/25_p...
I love this study. Do you know what's wildly more effective than phishing training? Preventing people from being phished. FIDO2, people.
... but you're still going to have to remind your coworkers that the CEO is not desperately texting them for iTunes gift cards
www.computer.org/csdl/proceed...
... but you're still going to have to remind your coworkers that the CEO is not desperately texting them for iTunes gift cards
www.computer.org/csdl/proceed...
November 19, 2024 at 2:09 PM
I love this study. Do you know what's wildly more effective than phishing training? Preventing people from being phished. FIDO2, people.
... but you're still going to have to remind your coworkers that the CEO is not desperately texting them for iTunes gift cards
www.computer.org/csdl/proceed...
... but you're still going to have to remind your coworkers that the CEO is not desperately texting them for iTunes gift cards
www.computer.org/csdl/proceed...