proomt

Search

Search posts, papers, and topics

webauthn

RSS
  1. 1

    I don't like passkeys

    Passkeys improve phishing resistance but introduce higher lock‑out risk for individuals. Hardware keys have low per‑device account limits and no backup, while synced passkeys tie you to Apple/Google and can be lost if the provider bans you. Third‑party managers are still immature. For most users, a strong password + TOTP combo remains safer than current passkey ecosystems.

    Hacker News front pagehawksley.dev3 minHN832803lobste.rs70
  2. 2

    WebAuthn Passkey Recovery: Building Account Fallbacks and Backup Codes in Node.js

    A step‑by‑step tutorial for building a zero‑trust WebAuthn passkey recovery flow in Node.js/TypeScript. It covers generating 128‑bit backup codes, hashing them with Argon2id, rate‑limited verification, time‑boxed JWT recovery sessions, and orchestrating new credential registration with @simplewebauthn/server while revoking lost credentials and rotating codes.

    SitePointsitepoint.com19 min