cccccchtnrvlnivdecdtnldvktbcchnhgligltuelidb

DHS will also start monitoring Certificate Transparency logs and notifying agencies of new certificates -- great for both the US government and the CT ecosystem. Taken together: clear actions using modern tools to directly mitigate a real known threat. A+ cyber.dhs.gov/ed/19-01/

I just used WebAuthn as my second factor with Google in the Apple mail program in OSX 10.15 beta. This shows that WebAuthn is part of the system webview and not just part of Safari. Thanks Apple I have been waiting for this for a long time.

Awesome work by the brave team on webauthn! I’m proud that YubiKit is part of this, and that we have been able to work so well together to show how easy secure authentication can be. 😁

Congrats on getting this done. Safe choices available by default on all platforms is foundational!

This year’s WWDC is big for the web! Stay tuned on Jun 24th to learn about how to use Touch ID and Face ID for the web. developer.apple.com/news/?id=e4u1m…

“What’s New in Safari 14” is live! Its “Authentication and Passwords” section mentions breached password notifications, domain-bound SMS codes, Web Authentication with Face ID and Touch ID, and PIN entry for security keys. developer.apple.com/documentation/…

I’m grateful and proud the webauthn/fido work Yubico, Google, Microsoft, Apple, and others have done has helped trip up some attackers! YubiKeys and friends help a lot if passwords are leaked, and can even help a bit if computers are compromised if the session system is great. 🙂

This really resonates with what we are aiming for with our team and program at Yubico. Read it all and think about what you might be able to achieve in your organization. IMO this is how we change common perceptions of our industry and make allies who will make us all safer!

1/ Today we extended support for hardware security keys for iOS/Android. This is important for anyone, but especially for frequently targeted groups like journalists, human rights defenders, political campaigns, gov officials, and public figures. about.fb.com/news/2021/03/e…

Use SSH with yubikey without gpg-agent: developers.yubico.com/PIV/Guides/SSH… Patch it for ECDSA as well: bugzilla.mindrot.org/show_bug.cgi?i…

Delegated Recovery launching in beta today with Open Source SDKs for Java, JS, and (by GitHub) Ruby. facebook.com/notes/protect-…

Sadly does not dispense vodka. St.George Bank (Yet? St. George Spirits)

Poking various security keys over USB to find issues: imperialviolet.org/2017/10/08/sec…

"If you give me six lines of C written by the hand of the most honest of men, I will find something in them which will trigger undefined behavior." -- Cardinal Richelieu

I caught my cat running out of my office with my yubikey in his mouth--a threat model I hadn't considered.

OH: “I love him, but he needs to get off Twitter.”