Top all-time · #2501
Firstyear's blog-a-log
Personal blog · fy.blackhats.net.ausecuritysystems
Firstyear's blog-a-log is a personal blog at fy.blackhats.net.au about security and systems. Since 2017, 33 different Hacker News readers have linked it 38 times, most often “Passkeys: A shattered dream”. It is still writing: the last post was on 2026-08-13, and you can follow it by feed.
Firstyear's blog
Most-linked posts?
- Passkeys: A shattered dream8 people · 10 mentions · first linked 2024-04-26
- Against Packaging Rust Crates4 people · 4 mentions · first linked 2021-02-22
- Hype Will Turn Your Security Key into Junk3 people · 3 mentions · first linked 2023-07-13
- Linux Filesystems2 people · 2 mentions · first linked 2024-08-13
- Yep, Passkeys Still Have Problems2 people · 2 mentions · first linked 2025-12-17
- Packaging, Vendoring, and How It’s Changing2 people · 2 mentions · first linked 2019-12-20
What Hacker News says?
It didn't have to be this way, but the hype train won over practical considerations: https://fy.blackhats.net.au/blog/2023-02-02-how-hype-will-tu...
Comment linking /blog/2023-02-02-how-hype-will-turn-your-security-key-into-junk/
on “Passkeys: A shattered dream”Submitted Passkeys: A shattered dream as a story · 969 points
HN discussion> But of course, thought leaders exist, and Apple hadn't defined what a Passkey was. One of those thought leaders took to the FIDO conference stage and announced "Passkeys are resident keys", at the same time as the unleashed a passkeys dev website (I won't link to it out of principal). I'm trying to follow the developments in the 2-factor-auth space and this was one thing that confused me a lot. I've read a lot of…
Comment linking /blog/2023-02-02-how-hype-will-turn-your-security-key-into-junk/
on “Passkeys: A shattered dream”Submitted Yep, Passkeys Still Have Problems as a story · 189 points
HN discussionK. To start with, it's been a common phrase in open source since before "open source" was invented and fairly self-explanatory; it means what it means on its face. Even if that weren't the case and someone were just encountering it for the first time in 2024, a 2-second attempt to get acquainted will not leave anyone wondering. There are 200 results for "patches welcome" on HN: < https://hn.algolia.com/?dateRange=al…
Comment linking /blog/2016-02-17-patches-welcome/
on “Fixing a bug in Google Chrome as a first-time contributor”Submitted Linux Filesystems as a story · 8 points
HN discussionYou'll probably enjoy this article from one of the original creators of the Passkey ecosystem: > Since then Passkeys are now seen as a way to capture users and audiences into a platform. What better way to encourage long term entrapment of users then by locking all their credentials into your platform, and even better, credentials that can't be extracted or exported in any capacity. https://fy.blackhats.net.au/blog/…
Comment linking /blog/2024-04-26-passkeys-a-shattered-dream/
on “What happened to running what you wanted on your own machine?”Submitted Hype Will Turn Your Security Key into Junk as a story · 8 points
HN discussionI'm really skeptical about passkeys. This blog post talks about it in detail: https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shatt... Also discussed on HN at the time: https://news.ycombinator.com/item?id=40165998 I think I'm fine with my uf2 / webauthn devices as second factor, thanks. (Edit: to be clear, I'm not the author of said blog post)
Comment linking /blog/2024-04-26-passkeys-a-shattered-dream/
on “Microsoft Confirms Password Deletion for 1B Users”Submitted Backup Yubikey Strategy as a story · 5 points
HN discussionEven though I work at a company that also supplies passkeys support to its customers, I feel it is worth for people to have a read of (1). The platform lock-in is a real problem we already see. Even password managers that sync the private key most of the times do not allow to export the key material. Oh, and if a customer ever wants to change the domain name for branding related stuff, is also where the fun starts.…
Comment linking /blog/2024-04-26-passkeys-a-shattered-dream/
on “Passkey Implementation: Misconceptions, pitfalls and unknown unknowns”Submitted Results from the openSUSE 2021 Rust Survey as a story · 4 points
HN discussionPasskey was a great idea. A brilliant solution which could have solved authentication on the web once and for all. If only Apple, Google and Microsoft had not completely ruined it by tying it to their platforms and using it as another moat https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shatt...
Comment linking /blog/2024-04-26-passkeys-a-shattered-dream/
on “How random are TOTP codes?”Submitted Time safety and Rust as a story · 4 points
HN discussionThe passkey spec authors think websites should be able to ban clients which allow users to manage their own data[1,2]. It makes me really hesitant to adopt passkeys if my client could get banned because it's open source and lets me control my client how I want to. It appears to be more useful for vendor lock-in than anything else[3]. A shame, since it could've been a cool tech if they had built it to be resilient to…
Comment linking /blog/2024-04-26-passkeys-a-shattered-dream/
on “Things I learnt about passkeys when building passkeybot”Submitted Against Packaging Rust Crates as a story · 3 points
HN discussionYes. That's one of the primary use cases of a YubiKey (or other FIDO 2 hardware keys). Please note that there are 2 types of passkeys: - resident keys: Actually stored on the hardware key - non-resident keys: Keys that are recalculated on the fly based on a secret seed value, the domain that the service is for and the username. The advantage is that these don't take up any storage space Resident keys have the advant…
Comment linking /blog/2024-04-26-passkeys-a-shattered-dream/
on “Passkeys are just passwords that require a password manager”Submitted (Linux) Bloat as a story · 2 points
HN discussion> Does it do anything to ensure data integrity, like journaling does? What kind of journaling though? By default ext4 only uses journaling for metadata updates, not data updates (see "ordered" mode in ext4(5) ). So if you have a (e.g.) 1000MB file, and you update 200MB in the middle of it, you can have a situation where the first 100MB is written out and the system dies with the other 100MB vanishing. With a CoW, if…
Comment linking /blog/2024-08-13-linux-filesystems/
on “Bcachefs may be headed out of the kernel”Submitted Open Source Enshrines the Wrong Privilege (2021) as a story · 2 points
HN discussionI wouldn't trust passkey myself [0] [0]: https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shatt...
Comment linking /blog/2024-04-26-passkeys-a-shattered-dream/?ref=labnotes.org
on “Concerns raised over Bitwarden moving further away from open source”Submitted Against Packaging Rust Crates as a story · 2 points
HN discussionUnless the service you are trying to log in to requires you to only use an approved authenticator, as is explicitly supported by the spec[1]. [1] "To be very honest here, you risk having KeePassXC blocked by relying parties." https://github.com/keepassxreboot/keepassxc/issues/10407#iss... More examples here https://fy.blackhats.net.au/blog/2025-12-17-yep-passkeys-sti...
Comment linking /blog/2025-12-17-yep-passkeys-still-have-problems/
on “Microsoft suspends dev accounts for high-profile open source projects”Submitted Against Packaging Rust Crates as a story · 2 points
HN discussionThe Problem with Passkeys https://bulwark.id/blog/problem-with-passkeys https://news.ycombinator.com/item?id=35496213 There’s a big problem with Apple and Google’s plans to nix passwords https://www.fastcompany.com/90755838/theres-a-big-problem-wi... Passkeys: A Shattered Dream https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shatt... https://news.ycombinator.com/item?id=40165998
Comment linking /blog/2024-04-26-passkeys-a-shattered-dream/
on “Will passkeys ever replace passwords? Can they? Here's why they should”Submitted Rust RwLock and Mutex Performance Oddities (2018) as a story · 2 points
HN discussionObligatory https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shatt... It's a shame, because WebAuthn is really great technology. But tech companies are botching the rollout.
Comment linking /blog/2024-04-26-passkeys-a-shattered-dream/
on “Passkeys were invented by engineers with zero understanding of consumer brain”Submitted Packaging, Vendoring, and How It’s Changing as a story · 2 points
HN discussion> I've encountered multiple sites that now use authenticatorAttachment options to force you to use a platform bound Passkey. In other words, they force you into Microsoft, Google or Apple. No password manager, no security key, no choices. https://fy.blackhats.net.au/blog/2025-12-17-yep-passkeys-sti... and more discussion here: https://news.ycombinator.com/item?id=46301585
Comment linking /blog/2025-12-17-yep-passkeys-still-have-problems/
on “XSS Is Deadly for Passkeys: The Hidden Risk of Attestation None”Submitted Kerberos: why the world moved on as a story · 2 points
HN discussion
