Weekly Update 510: Live From Mallorca with Scott Helme2 months agohttps://www.troyhunt.com/weekly-update-510/八年前，Scott 和作者创建了 Why No HTTPS? 来谴责那些未实施 TLS 安全协议的公司和国家。该网站采用了一种基于国家的有趣谴责方式，以鼓励采用传输层安全协议。去年作者遭遇钓鱼事件后，他们注册了 Why no Passkeys? 作为 TLS 版本的继任者。由于作者时间不足，而 Scott 精通 Claude Code，Scott 独自完成了该项目，取得了出色的成果。作者呼吁人们访问该网站，并鼓励所在国家的重要实体采用通行密钥。
Opaque, Interoperable Passkey Records (and a Go API)2 months agohttps://words.filippo.io/passkey-record/Passkeys are critical for phishing resistance, similar to how memory safety addresses memory corruption.Server-side implementation of passkeys can be complex, but interoperable passkey record encodings can simplify this.The proposed passkey record format is $webauthn$v=1$transports=<type>$<base64 authenticator data>, reusing existing WebAuthn encodings.Applications only need to store passkey records per user, similar to managing passwords, with the library handling verification.The Go API draft uses RelyingParty methods for registration (NewRegistration, Register) and login (NewLogin, Login) flows.Applications manage opaque user IDs, store passkey records, and cache request challenges, while the library handles JSON parsing.The proposed model avoids credential ID collision attacks by not using a credential ID index, relying on user ID lookup instead.