Quite a few people have sent me the "Passkeys are a trap. Do not use them." post on Substack.
The post recommends people abandon passkeys and stick to passwords + TOTP, citing what appears to be concerns with attestation as the primary reason.
I’ve written a rebuttal as this is really dangerous advice and it's based on some incorrect technical claims.
ai bro in front of squared paper leering at a the latest ai hot slop github url the mr beast face du jour?
If you actually read the “Passkeys are a trap. Do not use them.” post going around, you’ll find a transparent attempt to clumsily string together a conspiracy.
The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow.
The post posits that a website like X will bait and switch users: first, you get a passkey. Then, later, scary “attested” passkeys! This simply isn’t possible to do because attestation isn’t supported on the web for mass market, consumer authentication.
Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join.
And trust me, websites and apps like banks repeatedly asked for attestation at the beginning of the industry’s passkey journey. The platforms, browsers, and credential management apps have held firm that the goal of passkeys is reducing phishing and **not** some kind of trusted computing scheme. (And I will note: over my dead body!)
Besides the theory of the case being fundamentally wrong, there are several things that make the post disqualifying in terms of arguing something useful or important in the realm of security, privacy, and user authentication:
1. Intentionally presenting things that are complicated as inherently suspicious. (Delivering security by design can be complicated, yes!)
2. Describing TOTP as a “great solution” for adding security to a password-based account. When the most common threat model on the web is phishing (a word the post never mentions!), TOTP hardly buys you _anything_. TOTP is phishable.
3. Seeming to be unbothered by how many logical leaps are being taken without actually understanding the topic being discussed.
There are bad things happening in tech and untrustworthy people and companies do exist, but they’re largely in the AI space, not the “let’s stop people we love from getting compromised through phishing” space.
Publishing “Cryptographic Right Answers” for developers is a tradition by now.
Colin Percival started in 2009, Thomas Ptacek followed up in 2015, and then Latacora carried on in 2018 and 2024.
I put together an updated list. I'm very pleased (and mildly surprised) that at this point we have good post-quantum answers for everything.
Now we "just" need to get everything rolled out, and make Merkle Tree Certificates happen.
Let's get to work. See you in 2029.
P.S. the video totally IS coming 😤
I feel this in my bones.
My failure to produce/deliver contains multitudes, but this is the core of the issue. The audience and (more importantly) exchange for any type of content have all but collapsed. And the “AI” discourse is either science, ethics yelling fights, or markdown astrology. I have no interest in participating in any of those fields.
RE: https://hachyderm.io/@datarama/117413707701475859
otoh they won a land war against the australian army
love the new slop email spam format of:
“””
Love your {{ GITHUB_PROJECT }} because {{ LLM_PRAISE }}.
Here’s a thing I'm shilling: …
“””
Python 3.15.0 release day (second attempt)!
✅ Release date updated in What's New in Python 3.15 https://github.com/python/cpython/pull/159053
✅ No release blockers https://github.com/python/cpython/labels/release-blocker
✅ No deferred blockers https://github.com/python/cpython/labels/deferred-blocker
✅ Buildbots all green https://buildbot.python.org/release-status/
holy shit I got a free NordVPN subscription and their macOS client installs an endpoint kernel extension that just hangs around after an uninstall. There was a constant com.nordvpn.macos.Shield process.
I had to boot into recovery and disable SIP to get rid of it. Part of that is on macOS that it allows to install extensions but systemextensionsctl can't uninstall them.
But still, this is malware-grade behavior; especially given how sketch they are in general.
https://www.reddit.com/r/MacOS/comments/142cv0n/how_to_remove_stubborn_systemextensions_not/
RIP Margaret Hamilton
https://news.mit.edu/2026/margaret-hamilton-computing-pioneer-dies-1007
RE: https://publicidentity.net/@jezdez/117365085500527409
great day to sponsor PSF's infra, too 😇👛
a good day to advertise https://kapeli.com/dash ;) #hugOps
(I noticed because my monthly update builds failed due to intersphinx 😬)
LM and I can’t stress this enough AO
If you click thru, it’s actually even worse than it sounds.
Still recovering, so full write up to come, but this week at @djangomed, @judy2k and I bootstrapped django-bgt, supervised background threads for Django, on top of @hynek's new bgt.
django-bgt provides a simple service decorator, management command, and atomic leader election for all the DBs supported by Django's ORM. (Channels based wakeups are just a few tests away.)
Thanks to @hynek showing the way, django-bgt is a very exciting new tool for supervised periodic work in Django 🤩 1/2
Traveling keeps reminding me of how much work it is to:
a) deal with impromptu to-do items (usually via email)
b) keep everything charged
Somehow we’re serfs to email and chargers, and nobody is setting shit on fire.
my best explanation why seemingly all young people smoke now is that they’ve never been to a restaurant full of smokers or a train car or an airplane or a bar. Never have all their clothes smell like shit after a night out. That makes it seem more like a cute counter-culture rebellion.
And of course the fucking vaping -> cigarettes pipeline (because it’s cheaper).
I really thought my generation killed smoking but walking past schools nowadays is heartbreaking.
Everyone I know from FOSS has a bullying story and this shit is NOT cool. Don't come into my @'s trying to tell me "but this time we're right Elizabeth. This time we're right. Because blah blah AI bad." AI IS bad but harassing people isn't the fucking way you deal with this. This is some terminally online crap.
I've been in FOSS for 23 years and it's always been bullying, harassment, and coming up with new and exciting justifications for it. I have never bought it. I never will.
Happy Negroni week to everyone who celebrates!
@matmair The nefarious-yet-likely take is that someone is trying to produce “how to learn SWE now” content and is farming material. Absolutely everything is adversarial now.