← Feed

Posts

• View post

  Never trust how you feel about your life on less than four hours of sleep.

• View post

  RE: https://mastodon.social/@monkeydom/117382425456803989 100% true. “Automatic passkey upgrades” is a feature of WebAuthn that allows for websites and apps to turn around and add a passkey to your saved account in a password manager right after you sign in with your password, assisted by that password manager. Apple Passwords allows these upgrades by default (and tells users when it happens!) and I strongly believe it’s the right default. Why? Passkeys make signing into accounts faster than...

• View post

  Over the weekend, a person armed with a coding agent opened **479** pull requests against the Password Manager Resources project. As open source maintainers, what are we supposed to do about this? All of the justification prose is written in clear AI dialect, with awkward phrasing. The normal benefit of the doubt I am able to give to contributors of the project, including that the changes they’re submitted are motivated by something that makes sense, are out the window.

• View post

  You all need to realize how insufferable I will become when CHVRCHES are back. I love them so, so much.

• View post

  thinking about the one-two punch of the brain damage of repeated covid infections followed by “AI” for a sizable portion of the population

• View post

  Found a little dude near the trash can. What is it?

• View post

  The name “TransUnion” implies a function and reason for being way cooler than is actually the case.

• View post

  Here’s the blog post I promised y’all on how I recommend switching password managers in 2026! It covers: - why your iPhone or iPad, and not your Mac, might be the place to start your switch - when to make the switch and how to treat your “old” app going forward - tips and tricks for switching to Apple Passwords, if that’s where you’re going (can be skipped!) - the recent controversy in password management and some thoughts on values https://rmondello.com/2026/09/07/switching-password-managers-2...

• View post

  I’m working on the post. I haven’t forgotten. https://hachyderm.io/@rmondello/117207954401393470

• View post

  RE: https://mastodon.social/@fj/117003167043669505 Happy birthday to Signal!

• View post

  Hi Mastodon! I’m looking for help trying to understand more about how bulk email sending works in practice. To improve the experience of signing users in to websites, I’m thinking about working to introduce a standard email header for authentication-related one-time codes, so that, just from headers, email clients are aware of contained codes. What I don’t know: Do bulk email sender facilitators allow setting custom headers? Or would they be open to allowing a *value* for a custom header if it...

• View post

  This is the way. https://ottawa.place/@stephanie/113352754042936499

• View post

  “You saw [speedrunner] climb up those rocks? That’s a trick that we call ‘rock climbing’.” I love Summer Games Done Quick. :)

• View post

  Sunday night (derogatory)

• View post

  I have a weird feeling that Graham Platner is going to fuck us all one day.

• View post

  all my Senate gone

• View post

  I’m not sure I’ve ever purchased an upgrade to software faster than with Soulver 4. Soulver helps me with so many little things in my life. https://soulver.app/

• View post

  We been spending most our lives shitting with a tummy parasite.

• View post

  I love taking my socks off.

• View post

  I’ve been to lots of outdoor shows over the years, but this is the first with an AQI over 200. Thank goodness for N95s. (Death Cab, Philly.)

• View post

  “What’s the matter, trainer?”

• View post

  A reminder: If we are internet or IRL friends, and you have a fast internet connection, I will happily house sit for you if that’s something you ever want or need. See my website for more details: https://rmondello.com/housesitting/

• View post

  If you’re not on the grind to promote your content to make a living, I think it may be morally bad to post on X.

• View post

  I recently learned about the existence of the Anthropic employee polycule. I want it on the record that I _would_ go to one of their parties, but only with a very trusted friend, and I explicitly would not eat or drink anything there. The goal would be to experience the most interesting people-watching of all time. It’d be like staring directly into the sun, but with human behavior.

• View post

  I’m in Las Vegas for the next few days to give a keynote at the Identiverse conference and learn as much as I can from everyone else. My talk is about how to think about passkeys from the perspective of doing the most good for the most people, while avoiding potential harms. Vegas isn’t exactly my scene, and it’s hot as hell here, so expect some interesting posting. 🔥🙃 (Also, it’s wild to be featured on a website next to a sitting congressman. https://identiverse.com)

• View post

  RE: https://mastodon.social/@anon_opin/116702557377738985 The ship has sailed on this, but this is a good opinion.

• View post

  Have you ever gotten that notification from Uber when you land at a major airport that encourages you to open the app to book a ride and wonder how they figured out your location? The first time I saw this I wondered who betrayed me and shared this data with them. It turns out that it might be nobody. iOS can publish notifications for an app based on a geographic region and that app doesn’t know the wiser unless and until you interact with it. I figured that if I didn’t know this, some of y’al...

• View post

  smol dog goes awoo (quietly)

• View post

  RE: https://tacobelllabs.net/@ultranurd/116545694379699205 A TOTP provides very little value on top of a passkeys if it’s saved in the same place, with the same access control as your passkey. So in practice, no, you don’t need one. Importantly, note that a TOTP is just as easily phished as a password or an SMS one-time verification code. Now, if your TOTP is stored and accessed separately, it may provide some value, but at that point, your threat model should be pretty advanced and off the be...

• View post

  RE: https://mastodon.social/@brandonbutler/116544219969179883 Today, you cannot save an Apple Account passkey to an arbitrary passkey manager. If that were to change, I will yell it from the rooftops, because it will eliminate a lot of confusion for folks, especially in the Apple Developer community and better model how passkeys should ideally work.