← Feed

Posts

• View post

  nobody wants to _think_ anymore

• View post

  To be clear, the websites have stopped asking for attestation. Or at least, they’ve stopped asking me. Why? Because they know there’s no use in asking — that the OS vendors, browsers, and passkey managers are unified on this front. And now they’ve seen firsthand that passkeys without attestation are awesome and a big step forward. https://cybersecurity.theater/@varx/117428884584457992

• View post

  If you actually read the “Passkeys are a trap. Do not use them.” post going around, you’ll find a transparent attempt to clumsily string together a conspiracy. The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow. The post posits that a website like X will bait and switch users: first, you get a passkey....

• View post

  The most succinct way I’ve found to describe X is, “A social network for punching down.”

• View post

  Never trust how you feel about your life on less than four hours of sleep.

• View post

  RE: https://mastodon.social/@monkeydom/117382425456803989 100% true. “Automatic passkey upgrades” is a feature of WebAuthn that allows for websites and apps to turn around and add a passkey to your saved account in a password manager right after you sign in with your password, assisted by that password manager. Apple Passwords allows these upgrades by default (and tells users when it happens!) and I strongly believe it’s the right default. Why? Passkeys make signing into accounts faster than...

• View post

  Over the weekend, a person armed with a coding agent opened **479** pull requests against the Password Manager Resources project. As open source maintainers, what are we supposed to do about this? All of the justification prose is written in clear AI dialect, with awkward phrasing. The normal benefit of the doubt I am able to give to contributors of the project, including that the changes they’re submitted are motivated by something that makes sense, are out the window.

• View post

  You all need to realize how insufferable I will become when CHVRCHES are back. I love them so, so much.

• View post

  thinking about the one-two punch of the brain damage of repeated covid infections followed by “AI” for a sizable portion of the population

• View post

  Found a little dude near the trash can. What is it?

• View post

  The name “TransUnion” implies a function and reason for being way cooler than is actually the case.

• View post

  Here’s the blog post I promised y’all on how I recommend switching password managers in 2026! It covers: - why your iPhone or iPad, and not your Mac, might be the place to start your switch - when to make the switch and how to treat your “old” app going forward - tips and tricks for switching to Apple Passwords, if that’s where you’re going (can be skipped!) - the recent controversy in password management and some thoughts on values https://rmondello.com/2026/09/07/switching-password-managers-2...

• View post

  I’m working on the post. I haven’t forgotten. https://hachyderm.io/@rmondello/117207954401393470

• View post

  RE: https://mastodon.social/@fj/117003167043669505 Happy birthday to Signal!

• View post

  Hi Mastodon! I’m looking for help trying to understand more about how bulk email sending works in practice. To improve the experience of signing users in to websites, I’m thinking about working to introduce a standard email header for authentication-related one-time codes, so that, just from headers, email clients are aware of contained codes. What I don’t know: Do bulk email sender facilitators allow setting custom headers? Or would they be open to allowing a *value* for a custom header if it...

• View post

  This is the way. https://ottawa.place/@stephanie/113352754042936499

• View post

  “You saw [speedrunner] climb up those rocks? That’s a trick that we call ‘rock climbing’.” I love Summer Games Done Quick. :)

• View post

  Sunday night (derogatory)

• View post

  I have a weird feeling that Graham Platner is going to fuck us all one day.

• View post

  all my Senate gone

• View post

  I’m not sure I’ve ever purchased an upgrade to software faster than with Soulver 4. Soulver helps me with so many little things in my life. https://soulver.app/

• View post

  We been spending most our lives shitting with a tummy parasite.

• View post

  I love taking my socks off.

• View post

  I’ve been to lots of outdoor shows over the years, but this is the first with an AQI over 200. Thank goodness for N95s. (Death Cab, Philly.)

• View post

  “What’s the matter, trainer?”

• View post

  A reminder: If we are internet or IRL friends, and you have a fast internet connection, I will happily house sit for you if that’s something you ever want or need. See my website for more details: https://rmondello.com/housesitting/

• View post

  If you’re not on the grind to promote your content to make a living, I think it may be morally bad to post on X.

• View post

  I recently learned about the existence of the Anthropic employee polycule. I want it on the record that I _would_ go to one of their parties, but only with a very trusted friend, and I explicitly would not eat or drink anything there. The goal would be to experience the most interesting people-watching of all time. It’d be like staring directly into the sun, but with human behavior.

• View post

  I’m in Las Vegas for the next few days to give a keynote at the Identiverse conference and learn as much as I can from everyone else. My talk is about how to think about passkeys from the perspective of doing the most good for the most people, while avoiding potential harms. Vegas isn’t exactly my scene, and it’s hot as hell here, so expect some interesting posting. 🔥🙃 (Also, it’s wild to be featured on a website next to a sitting congressman. https://identiverse.com)

• View post

  RE: https://mastodon.social/@anon_opin/116702557377738985 The ship has sailed on this, but this is a good opinion.