Oct 12, 2026, 1:14 PMPublishing “Cryptographic Right Answers” for developers is a tradition by now.
Colin Percival started in 2009, Thomas Ptacek followed up in 2015, and then Latacora carried on in 2018 and 2024.
I put together an updated list. I'm very pleased (and mildly surprised) that at this point we have good post-quantum answers for everything.
Now we "just" need to get everything rolled out, and make Merkle Tree Certificates happen.
Let's get to work. See you in 2029.
@filippo Thank you for putting this together.
Thanks for the insights. You mention passkeys positively yet an article just earlier pointed out the lack of digital sovereignty with these due to signing keys owned by the tech oligarchy. Must we choose between two evils or have I misunderstood?
Oct 12, 2026, 2:19 PM@bbuk It's easily disproved bullshit.
Just install Vaultwarden or KeePassX or whatever client you like. It's an open ecosystem. You can experimentally verify that.
The counterarguments are like "well, but if all the implementations were to change, it could change!" and uh, sure? Tautologies are tautologic, but they are not a description of reality.
I find it so frustrating that this reactionary crap is going to get people hurt by phishing attacks unnecessarily.
OK, you convinced me to actually look into passkeys again. I had felt that an offline 2FA device was better than anything running on the same machine or connected by USB (see previous yubikey and keepass vulnerabilities). I guess I should consider passkey + offline 2FA rather than passkey replacing the pasword/2FA combo entirely.
Clearly there's nothing in the passkey spec that necessarily relies on a single entity.
Oct 12, 2026, 2:55 PM@bbuk Phishing resistance is more important than offline anything.
A simple online passkey manager will protect you better than any password/2FA solution.
Avoid the trap of over-complicating the passkey setup to the point you revert back.
If you want *even more* security, you can put passkeys on multiple YubiKeys (multiple for backup purposes).
Well, I tried the only passkey app in the trixie repo, keepassxc. Sadly it crashed while the lid was closed and the dev's comments for the issue on github tells the users to go complain to wayland.
If debian can't package it out of the box and the dev's attitude is like that I can't trust it and I'll wait until something else exists before using passkeys.
Thankfully I hadn't added any data at that point and avoiding phishing is trivial anyway.
@filippo
Thank you, Filippo :))
Oct 13, 2026, 2:02 AM