Top all-time · #10088
Matt's Headroom
Personal blog · blog.millerti.mesecurityprogramming
Matt's Headroom is a personal blog at blog.millerti.me about security and programming. Since 2021, 8 different Hacker News readers have linked it 9 times, most often “Encrypting Data in the Browser Using WebAuthn”. It is still writing: the last post was on 2026-03-02, and you can follow it by feed.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN readers link this blog for technical posts on WebAuthn and passkeys, including the QR-code cross-device sign-in flow and using passkeys for browser-side encryption of data.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Notes for my future self
Most-linked posts?
- Encrypting Data in the Browser Using WebAuthn3 people · 3 mentions · first linked 2023-01-24
- Previewing Chrome's caBLE v2 support for WebAuthn3 people · 3 mentions · first linked 2021-08-21
What Hacker News says?
> you would need to find a way to sign into your old account (which requires your MacOS/iOS passkey to log in) Chrome and iOS will pop up a QR code for webauthn over BLE or whatever it's called (there's also caBLE[0]) whenever you're either enrolling or trying to log in via webauthn. This means that, as long as you have access to any device with your old passkeys, you can log in on your browser/android phone. 0: htt…
Comment linking /2021/06/18/previewing-chromes-cable-v2-support-for-webauthn/
on “Mozilla claims Apple, Google and Microsoft force users to use default browsers”Submitted Password managers aren't replacements for passkeys as a story · 4 points
HN discussionOne of the really cool uses of passkeys is cross-platform sign-in via the QR code flow. (i.e. passkey on phone, scan qrcode on desktop, desktop logs you in). However as I understand it, to be able to do this you need to use the platform's(google,apple, microsoft) caBLE infrastructure[0]. Will open-source passkey managers have the ability to hook into this? [0]: https://blog.millerti.me/2021/06/18/previewing-chromes-…
Comment linking /2021/06/18/previewing-chromes-cable-v2-support-for-webauthn/
on “Passkeys: A Loss of User Control?”Submitted Security Keys in the Land of Passkeys as a story · 2 points
HN discussionThis is why we need WebAuthn[1] supporting browser-side encryption using passkeys (or any other secure enclave)[2]. Relying on servers to encrypt data for you will be seen as comical 5 years from now. [1]: https://blog.millerti.me/2023/01/22/encrypting-data-in-the-b... [2]: https://sneakernetsend.com/
Comment linking /2023/01/22/encrypting-data-in-the-browser-using-webauthn/
on “Incognito Darknet Market Mass-Extorts Buyers, Sellers”Submitted Previewing Chrome's caBLE v2 support for WebAuthn as a story · 2 points
HN discussionOne possibility for WebAuthn over email/password is the easy retrieval of local, strong and domain-unique encryption key material via the prf extension. Support for this is currently limited to Chrome Canary + hardware key, but MasterKale thinks it will be coming to other browsers, and biometric: https://blog.millerti.me/2023/01/22/encrypting-data-in-the-b...
Comment linking /2023/01/22/encrypting-data-in-the-browser-using-webauthn/
on “Ask HN: Why is WebAuthn so slow to take off?”Submitted Encrypting Data in the Browser Using WebAuthn as a story · 1 points
HN discussionSubmitted WWDC 2022: Meet Passkeys as a story · 1 points
HN discussion