Top all-time · #9855
SlashID Blog
Company blog · slashid.dev/blog · on HN as snaggsecurityprogramming
SlashID Blog is the company blog at slashid.dev, writing about security and programming. Since 2022, 8 different Hacker News readers have linked it 35 times, most often “The good, the bad and the ugly of Apple Passkeys (2022)”. It is still writing: the last post was on 2026-10-05, and you can follow it by feed.
Too few sampled comments (5) to say how often HN recommends it.?
Why HN links it
Commenters link the blog's passkeys deep-dive when discussing whether synced passkeys stay in the Secure Enclave and can be exported. The blog is otherwise an identity-platform company's blog.
Summarised by Claude from a sample of 5 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
We stop identity breaches
Most-linked posts?
- The good, the bad and the ugly of Apple Passkeys (2022)5 people · 5 mentions · first linked 2023-01-19
- Passkeys: Threat Modeling and Implementation Considerations2 people · 3 mentions · first linked 2023-05-31
What Hacker News says?
SlashID | Principal Backend Engineer | REMOTE (EU compatible time-zones) | Full Time We’re an early stage startup building an identity platform. Our goal? Bring authentication for users, machines and APIs under the same (secure) umbrella (aka one identity platform to rule them all). We’re looking for people who can design, build, and maintain distributed systems at scale. You’re also driven, product-oriented and enj…
Comment linking /careers/principal-backend-software-engineer/
on “Ask HN: Who is hiring? (June 2024)”Submitted Show HN: HSM-backed PII storage directly from the front end as a story · 6 points
HN discussionShameless plug: I work to make this easier at https://www.slashid.dev/products/identity-protection/ And yes, you're absolutely right. Attempting to manage NHIs across multiple cloud/service providers without having proper automation in place is a total nightmare.
Comment linking /products/identity-protection/
on “OWASP Non-Human Identities Top 10”Submitted SlashID RBAC: Globally-available role-based access control as a story · 4 points
HN discussionHey, Co-founder of SlashID here (one of the companies mentioned above). I think we have exactly what you are looking for: https://www.slashid.dev/blog/anonymous-users/ https://developer.slashid.dev/docs/access/concepts/anonymous... Hit me up if you want to chat more: v@slashid.dev
Comment linking /blog/anonymous-users/
on “Comparing Auth from Supabase, Firebase, Auth.js, Ory, Clerk and Others”Submitted Protecting Exposed APIs from Leaks as a story · 4 points
HN discussionThe short answer is that it's non standard and it depends on where the passkeys are stored. To be precise, the original WebAuthn standard did not account for a recovery mechanism at all and instead recommended adding multiple credentials to an account. Practically if the passkeys are stored in your iCloud Keychain, they are automatically synced across your Apple devices and the recovery mechanism is the recovery mec…
Comment linking /blog/passkeys-security-implementation/
on “Tailscale doesn't want your password”Submitted Passkeys: Threat Modeling and Implementation Considerations as a story · 4 points
HN discussionWe wrote a long post on Passkeys, in particular how they are implemented by Apple[0] that might be interesting. Technically a Passkey is just a multi-device FIDO credential that is compatible with WebAuthn (which is an official W3C and FIDO spec). However, vendors implementations of Passkeys/FIDO credentials differ quite widely. The Apple implementation of Passkeys, as an example, doesn't provide attestation informa…
Comment linking /blog/passkeys-deepdive/
on “Bitwarden Acquires Passwordless.dev”Submitted Rate Limiting for Large-Scale, Distributed Applications Using GCRA as a story · 3 points
HN discussionWorth noting that implementing FIDO2/Passkeys is more challenging than it looks both from a UX standpoint and from a threat modeling standpoint. We tried to cover some of this in a blog post, in case anybody is interested: https://www.slashid.dev/blog/passkeys-security-implementatio...
Comment linking /blog/passkeys-security-implementation/
on “When MFA isn't MFA, or how we got phished”Submitted Adding Identity to Docusaurus as a story · 3 points
HN discussionHi, sorry for the late reply, just saw this. Do you mean to have certain pages public while others are private? If so, yes. You can make login optional (using the slashID.forceLogin parameter. See here: https://github.com/slashid/docusaurus-slashid-login/blob/mai... ) and restrict certain pages to only logged-in users. You can also use user groups/roles to further segment access to pages ( https://www.slashid.dev/bl…
Comment linking /blog/groups-react/
on “Adding Identity to Docusaurus”Submitted OAuth 2.0 Scopes enforcement on APIs as a story · 2 points
HN discussionI think you're the one who misunderstands. Synced Passkeys are, in the Apple world, still stored in a Secure Element; they just are exportable. https://www.slashid.dev/blog/passkeys-deepdive/ describes this fairly clearly. Syncing does certainly open up attacks that are not possible against non-synced credentials, but you're incorrect to say that synced Passkeys are not stored in the Secure Element.
Comment linking /blog/passkeys-deepdive/
on “Ask HN: Why do we need "Passkeys"”Submitted Firewalling OpenAI APIs as a story · 2 points
HN discussionWe are big proponent of app-layer encryption as well. We wrote extensively about how we do it for our specific use case: https://www.slashid.dev/blog/app-layer-encryption/
Comment linking /blog/app-layer-encryption/
on “Securing Your PostgreSQL DB with Roles and Privileges”Submitted App-layer cryptographic primitives for secure storage of user data as a story · 2 points
HN discussionHi, I'm the author of the SlashID blogpost. You are right, the WebAuthn standard doesn't provide any guarantees on the authenticator storage security hence passkeys (and WebAuthn creds) can be stored in anything that speaks CTAP2. We wrote a follow-up blogpost talking about the threat model in which we touch on the above: https://www.slashid.dev/blog/passkeys-security-implementatio...
Comment linking /blog/passkeys-security-implementation/
on “Understanding Passkeys”Submitted Context-Aware Authentication as a story · 1 points
HN discussionPer this: https://www.slashid.dev/blog/passkeys-deepdive/ The private key is both kept in your phone’s Secure Enclave and stored in iCloud, so strictly speaking the implementation isn’t hardware-bound in that case. But I think the intended point is something more practical: can you, as a user, export the passkey to be shared on your non-Apple laptop, phone, etc? And maybe I’m mistaken, but I’ve been under the impres…
Comment linking /blog/passkeys-deepdive/
on “Understanding Passkeys”Submitted Back End Authentication and Authorization Patterns as a story · 1 points
HN discussionhttps://www.slashid.dev/blog/passkeys-deepdive/ talks about this, among others. I think Apple mentions it in a WWDC presentation as well, but I find it quite ridiculous to bury such a significant change in a video + transcript announcement.
Comment linking /blog/passkeys-deepdive/
on “KeePassXC pull request to add basic support for WebAuthn”Submitted No-code anti-phishing protection of internal apps with Passkeys as a story · 1 points
HN discussionWe spent some time putting together a threat-model and taxonomy of attacks paths for Passkeys in case anybody is interested: https://www.slashid.dev/blog/passkeys-security-implementatio... Passkeys are definitely a leap forward in that we are shifting the bulk of the account takeover risk from the end users using weak passwords or clicking on phishing links to: 1) The server side implementation, including any mechan…
Comment linking /blog/passkeys-deepdive/
on “Passkeys now support external providers”Submitted Ditch Your Organizations Table as a story · 1 points
HN discussionThis is an area with the specs contrast with the vendors. The WebAuthn specs recommends to register multiple passkeys/credentials per device and assume that once a credential is lost it might not be recoverable. Apple and other vendors using keychains/wallets are effectively offering the option to delegate the recovery of the passkey to the recovery of the account with them (eg: the iCloud account). In case it is of…
Comment linking /blog/passkeys-security-implementation/
on “Passkeys now support external providers”Submitted Analytics and Webooks for Authentication as a story · 1 points
HN discussionSubmitted The good, the bad and the ugly of Apple Passkeys (2022) as a story · 1 points
HN discussionSubmitted Passkeys: Threat Modeling and Implementation Considerations as a story · 1 points
HN discussion