Jonathan Cecil

I work @ a Tech firm, author blogs and explore technology.

[Jonathan Cecil @techwithjoe_io]

GitHub is reporting an incident affecting Actions, Pull Requests, and Issues.

https://t.co/nfUfHEZEbp

[Jonathan Cecil @techwithjoe_io]

Passkeys solved the most pervasive vulnerability in internet history - credential phishing - only to construct the cryptographic foundation for platform gatekeeping. When an essay titled "Passkeys are a trap" surged to the top of Hacker News today with nearly 800 upvotes and over 430 comments, it exposed a simmering architectural fault line between enterprise security teams and open-web advocates.

The FIDO Alliance's original pitch was compelling: kill the shared secret once and for all. No plaintext database breaches, no SMS SIM-swapping, and complete mathematical immunity against adversary-in-the-middle reverse proxies like Evilginx. But beneath the consumer marketing of friction-free biometric logins, developers and privacy researchers are sounding alarms over a structural threat: the normalization of hardware-level remote attestation.

⚙️ Under the Hood: WebAuthn, AAGUIDs, and Attestation Pipelines

At the protocol level, WebAuthn replaces passwords with asymmetric cryptography (typically secp256r1 or Ed25519) strictly bound to an origin Relying Party ID (RP ID). The authenticator signs an ephemeral server challenge over TLS, making phishing across malicious lookalike domains mathematically impossible.

The engineering friction does not stem from the signature scheme - it lies in the attestation handshake:

1. Device Attestation & Certificate Chains: During credential registration, a Relying Party (RP) can specify an attestation requirement (`none`, `indirect`, `direct`, or `enterprise`). If requested, the authenticator emits an Attestation Object carrying an Authenticator Attestation Globally Unique Identifier (AAGUID) along with an X.509 certificate chain rooted in the vendor's hardware signing key (e.g., Apple Secure Enclave, Android StrongBox/KeyMint, or TPM 2.0).

2. Silent Ecosystem Whitelisting: While consumer registrations frequently default to anonymized attestation (`none`), the specification permits relying parties - such as banks, corporate SSO providers, and government portals - to inspect the AAGUID and enforce strict authenticator whitelists. Any client without a recognized Big Tech hardware root can be summarily rejected at the handshake level.

3. The Synced Credential Enclosure: Multi-device credentials resolve the lost-phone recovery dilemma by encrypting private keys inside iCloud Keychain or Google Password Manager. However, genuine cross-platform portability remains fractured. Operating across independent password vaults, headless developer environments, or Linux machines frequently forces users into brittle device-to-device QR handshakes over hybrid Bluetooth/WebSocket transports (CTAP2/caBLE).

⚖️ The Architectural Collision

The current controversy stems from two fundamentally opposing threat models:

To enterprise CISOs and identity architects, device attestation is an essential defensive control. It proves cryptographically that a private key resides inside a tamper-resistant hardware module rather than an exploitable software memory space on a compromised endpoint. Passkeys eliminate the attack vector responsible for the vast majority of account takeovers worldwide.

To open-source developers and system purists, WebAuthn attestation represents Web Environment Integrity resurrected through authentication. If relying parties begin mandating attestation from approved hardware vendors, open-source managers (KeePassXC, Bitwarden), custom operating systems (GrapheneOS), and independent browsers (Firefox on Linux) will face systematic lockout - mirroring how mobile banking applications already weaponize Google Play Integrity to ban rooted devices.

💡 The Takeaway

Passkeys remain the undisputed gold standard for cryptographic authentication, but granting relying parties the ability to police client hardware legitimacy turns an open security primitive into an ecosystem moat. For software architects and protocol designers, the priority must be defending phishing resistance while rejecting remote hardware discrimination before the open web is reduced to an approved corporate perimeter.

Source: https://t.co/mwEvpLx5ZU

[Jonathan Cecil @techwithjoe_io]

Microsoft is rolling out its Maia AI chip to reduce reliance on Nvidia GPUs across its cloud infrastructure. https://t.co/b8UCNdRVjB

[Jonathan Cecil @techwithjoe_io]

Open-source geospatial project QGIS is moving to ban AI-assisted contributions under a new enhancement proposal.

https://t.co/S8jNzzkkCf

[Jonathan Cecil @techwithjoe_io]

A former Plaud executive has raised $26 million for an AI application designed to listen in the background.

https://t.co/8oI1ex0knC

[Jonathan Cecil @techwithjoe_io]

PS2 games can now be statically recompiled directly to WebAssembly to run in the browser.

https://t.co/oacIGZ1Xbg

[Jonathan Cecil @techwithjoe_io]

Potential malware compromise reported for Zod 4.6.6: https://t.co/0oYxA8eYwX

[Jonathan Cecil @techwithjoe_io]

Wordcraft is an open-source, clean-room reimplementation of Microsoft Word in pure Rust: https://t.co/KGt94jbQn5

[Jonathan Cecil @techwithjoe_io]

Sakana AI released research on recursive self-improvement through collective intelligence: https://t.co/AW6DblUcU4

[Jonathan Cecil @techwithjoe_io]

@aparnadhinak Silent regressions kill us on fuzzy workflows. Curious how you're scoring agent runs without ground truth.

[Jonathan Cecil @techwithjoe_io]

@IamAroke We lost our DB connection pool to an unvetted query last year. Do you enforce complexity limits right at the gateway?

[Jonathan Cecil @techwithjoe_io]

BetterWispr, a free and open-source dictation tool for Mac, has been released: https://t.co/it23rL82Au

[Jonathan Cecil @techwithjoe_io]

Valen details a new approach to borrow checking and memory safety: https://t.co/7nLsiO8NIn

[Jonathan Cecil @techwithjoe_io]

NASA has published over 800GB of Artemis II mission data online: https://t.co/OGvqvQEymJ

[Jonathan Cecil @techwithjoe_io]

Cloudflare Radar data shows a sudden drop in bot traffic following a strike on a Yandex datacenter: https://t.co/fErLq3l69g

[Jonathan Cecil @techwithjoe_io]

Yandex Cloud reports an incident impacting its third data center: https://t.co/zaLWDx65WW

[Jonathan Cecil @techwithjoe_io]

Microsoft CEO Satya Nadella says organizations should operate under the assumption that all AI models are 'compromised.'

https://t.co/U3y5MIIREQ

[Jonathan Cecil @techwithjoe_io]

MotherDuck details the architectural updates and performance optimizations introduced in DuckDB 2.0: https://t.co/kgP3Ig9Ycp

[Jonathan Cecil @techwithjoe_io]

Nvidia is in talks to acquire Reflection AI, a US startup focused on open models.

https://t.co/YfhEgteEZr

[Jonathan Cecil @techwithjoe_io]

Apple has reached a deal to hire the team behind personalized podcast startup Huxe and license its technology. https://t.co/oAHlNVMY4S