New Open-Source Tool Spotlight

Pocket ID is an OIDC provider simplifying authentication with passkeys. No passwords. Think secure logins using Yubikeys or biometrics. Lightweight compared to Keycloak or Hydra and ideal for focused use cases. Built for Docker setups. #Passkeys #OIDC

Project link on #GitHub https://github.com/pocket-id/pocket-id

#Infosec #Cybersecurity #Software #Technology #News #CTF #Cybersecuritycareer #hacking #redteam #blueteam #purpleteam #tips #opensource #cloudsecurity

—
P.S. Found this helpful? Tap Follow for more cybersecurity tips and insights! I share weekly content for professionals and people who want to get into cyber. Happy hacking

#Passkeys are pretty cool, but the shotgun approach to implementation is horrendous.

It really grinds my gears that every browser, password manager++ tries to swoop in and steal that user flow.

Suddenly you've created and added passkeys to services without your intention, no knowing what key is used, which service has it or whether it's bound to hardware or roaming. It could be in the cloud for all you know.

I'm struggling to keep track, and I work with this every day...

I love #PocketID, a light weight #selfhosted #OIDC using only #Passkey.

After using it for several months with an LXC installation using Proxmox Helper Scripts, I noticed that the service runs as root. I also learned that a VM installation is more secure than an LXC. This article will guide you through installing Pocket-ID as a non-root service on Debian. Additionally, there's an upgrade script included.

#Proxmox #debian #selfhosting #homelab #openID #passkeys #SSO

https://www.lucasjanin.com/2025/06/02/pocket-id-bare-metal-installation-on-debian

I needed to read that in two languages to make it make sense

I can only imagine how confusing it must be for end users

https://support.google.com/a/answer/13529161

Whoa, a bank supporting #passkeys! Never thought I'd see the day.

I didn’t even notice the typo originally. I was just lamenting the inability to label registered keys. So not only does Intuit not let you name your passkeys, they actually have a typo in their automatic naming scheme. “Unkown” #Passkeys https://mastodon.social/@dmnelson/114519226663351335

If you support #Passkeys *please* allow the user to rename them.

"The cryptography behind passkeys"

https://blog.trailofbits.com/2025/05/14/the-cryptography-behind-passkeys/

Beta Release: 1Password now supports Windows 11 Passkeys!

https://www.reddit.com/r/1Password/comments/1kmelsf/beta_release_1password_now_supports_windows_11/

Passkeys for Normal People, by @troyhunt:

https://www.troyhunt.com/passkeys-for-normal-people/

Passkeys use public key cryptography to authenticate users without exposing secrets. WebAuthn adds phishing resistance via origin binding. But they're not bulletproof—device malware and weak recovery paths remain risks.

https://blog.trailofbits.com/2025/05/14/the-cryptography-behind-passkeys/

The UI/UX around #passkeys is SO BAD. I fully understand passkeys on a technical level yet even so I feel like I'm fighting accidental dark UI/UX patterns the entire time I am deploying them.

Password manager, browser, and OS all seem to fight for passkey flow UI. UI is inconsistent. Text is vague.

Handle MFA like a pro so you don’t get locked out or let the bad guys in

Why you should use MFA, what about passkeys, what kind of MFA to use, how to make it easier to use, and how to protect yourself against being locked out of an account because of MFA.
#infosec #MFA #passwordManager #passkeys
https://blog.kamens.us/2025/05/06/handle-mfa-like-a-pro-so-you-dont-get-locked-out-or-let-the-bad-guys-in/

Microsoft - the Walmart of passkeys...

Microsoft’s new “passwordless by default” is great but comes at a cost

https://arstechnica.com/security/2025/05/microsoft-pushes-unphishable-logins-forward-with-new-sign-in-options/

Samsung's clipboard #security flaw exposes all copied content, including passwords, as plain text indefinitely.

Users are advised to avoid using the clipboard for sensitive #information until a fix is implemented.

#Samsung moderators acknowledge the issue and are considering enhancements for future updates.

For now, consider using #passkeys for secure authentication.

Stay vigilant.

https://www.tomsguide.com/computing/online-security/samsung-phone-security-flaw-leaves-passwords-exposed-protect-yourself-now

When using #passkeys I experience one of these 3 behaviors:

1. Immediately logged in (even if #MFA is enabled)
2. I’m prompted for an MFA token
3. I’m only asked for my passkey after I’ve entered some amount of other information. Possibly just and email or phone number or sometimes my full login/password where the passkey is acting as an MFA token.

Would be nice if this was consistent. Feels like rolling UX dice every time.

https://sphinx.pm/

Now supports #webauthn #passkeys #passwordmanager

There is this joke, that you could have your SPHINX server hosted by the NSA