William Brown

Obligatory https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream… It's a shame, because WebAuthn is really great technology. But tech companies are botching the rollout.

Passkey was a great idea. A brilliant solution which could have solved authentication on the web once and for all. If only Apple, Google and Microsoft had not completely ruined it by tying it to their platforms and using it as another moat https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream…

Even though I work at a company that also supplies passkeys support to its customers, I feel it is worth for people to have a read of (1). The platform lock-in is a real problem we already see. Even password managers that sync the private key most of the times do not allow to export the key material. Oh, and if a customer ever wants to change the domain name for branding related stuff, is also where the fun starts. My 2 cents are that passwords/2fa, passkeys, federation and maybe soon verifiable credentials are concepts that will work for a long time in parallel. So, if you ever choose a system that does the "identity/authentication" plumbing work for you, I think you should focus solutions that are open source and allow you to mix and match the different concepts. IMO this applies to b2c and b2b alike ;-) [1] https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream…

> I've encountered multiple sites that now use authenticatorAttachment options to force you to use a platform bound Passkey. In other words, they force you into Microsoft, Google or Apple. No password manager, no security key, no choices. https://fy.blackhats.net.au/blog/2025-12-17-yep-passkeys-still-have-pr… and more discussion here: https://news.ycombinator.com/item?id=46301585

Unless the service you are trying to log in to requires you to only use an approved authenticator, as is explicitly supported by the spec[1]. [1] "To be very honest here, you risk having KeePassXC blocked by relying parties." https://github.com/keepassxreboot/keepassxc/issues/10407#issuecomment-… More examples here https://fy.blackhats.net.au/blog/2025-12-17-yep-passkeys-still-have-pr…

I'm really skeptical about passkeys. This blog post talks about it in detail: https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream… Also discussed on HN at the time: https://news.ycombinator.com/item?id=40165998 I think I'm fine with my uf2 / webauthn devices as second factor, thanks. (Edit: to be clear, I'm not the author of said blog post)

I wouldn't trust passkey myself [0] [0]: https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream…

It seems like you may have accidentally enabled passkeys: https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream… Maybe someone else can confirm?

It didn't have to be this way, but the hype train won over practical considerations: https://fy.blackhats.net.au/blog/2023-02-02-how-hype-will-turn-your-se…

They will turn our security keys into junk: https://fy.blackhats.net.au/blog/2023-02-02-how-hype-will-turn-your-se…

> Does it do anything to ensure data integrity, like journaling does? What kind of journaling though? By default ext4 only uses journaling for metadata updates, not data updates (see "ordered" mode in ext4(5)). So if you have a (e.g.) 1000MB file, and you update 200MB in the middle of it, you can have a situation where the first 100MB is written out and the system dies with the other 100MB vanishing. With a CoW, if the second 100MB is not written out and the file sync'd, then on system recovery you're back to the original file being completely intact. With ext4 in the default configuration you have a file that has both new-100MB and stale-100MB in the middle of it. The updating of the file data and the metadata are two separate steps (by default) in ext4: * https://www.baeldung.com/linux/ext-journal-modes * https://michael.kjorling.se/blog/2024/ext4-defaulting-to-data-ordered/ * https://fy.blackhats.net.au/blog/2024-08-13-linux-filesystems/ Whereas with a proper CoW (like ZFS), updates are ACID.

K. To start with, it's been a common phrase in open source since before "open source" was invented and fairly self-explanatory; it means what it means on its face. Even if that weren't the case and someone were just encountering it for the first time in 2024, a 2-second attempt to get acquainted will not leave anyone wondering. There are 200 results for "patches welcome" on HN: <https://hn.algolia.com/?dateRange=all&page=5&prefix=false&… The top results on Google for the phrase "patches welcome", most being posts written around the 4-, 5-, 6-year mark after the post I linked to, are all based on the same premise: "patches welcome" is (a) common, and (b) not what anyone wants to hear. <https://www.google.com/search?num=100&q=%22patches%20welcome%22>… E.g.: > "Patches Welcome". We've all seen it in the Open Source community. Nothing makes me angrier than these two words. <https://fy.blackhats.net.au/blog/2016-02-17-patches-welcome/> But I'm also missing some context here; my "Huh?" was rather more directed at the part of the remark that says "[...] for me to agree or disagree with it".

The Problem with Passkeys https://bulwark.id/blog/problem-with-passkeys https://news.ycombinator.com/item?id=35496213 There’s a big problem with Apple and Google’s plans to nix passwords https://www.fastcompany.com/90755838/theres-a-big-problem-with-apple-a… Passkeys: A Shattered Dream https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream… https://news.ycombinator.com/item?id=40165998