SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

FIDO2 Security Keys vs Passkeys: How Their Modes and Attestation Differ for AAL3

0
·4 views

Security key deployments involve three separate choices: how the key is used, how the server identifies it, and what the user sees during interaction. The relying party controls the key's behavior through the options it passes to navigator.credentials.create(), notably residentKey and userVerification settings. Both U2F-style second-factor and passkey-style on-key modes can meet NIST AAL3 at the authenticator level, though the full authentication process must also satisfy FIPS 140 validation and related requirements. Synced passkeys do not qualify because their keys are exportable, and attestation remains the only reliable way for a server to confirm genuine hardware. Attestation formats vary by key and browser, so verifiers must handle both fido-u2f and packed formats, using AAGUIDs or certificate key IDs for FIDO Metadata Service lookups; in the cited data, 81% of attested security key registrations passed the checks.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

How Claude's custom connector discovers osFoundry's OAuth server and why access is checked on every call

A technical write-up examines how remote MCP clients such as Claude's custom connector find osFoundry's OAuth login page after an unauthenticated request returns a 401 response. The author tested the production endpoint with curl from Tokyo and showed that the handshake and tool listing are public while tool calls require a token. The article describes the 59 available tools, their OAuth scopes, and the read-only annotations hosts can use to decide when to prompt for confirmation. It also explains the RFC 9728 resource metadata path, which is a common stumbling point for developers building their own clients. Finally, it outlines the authorization server settings, including dynamic client registration, PKCE, and a consent page that grants access to a single workspace.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

H-1B Job Switch: Can You Start on the Filing Date or Must You Wait for Approval?

Under H-1B portability rules, a worker changing employers may often begin work once the new employer properly files a non-frivolous Form I-129, or on the petition's stated start date if that is later, rather than waiting for approval. Eligibility requires lawful H-1B status, a filing made before the authorized stay expires, and no unauthorized work since the last admission. Workers should wait until the employer confirms filing and receives a USCIS receipt, and expect a new Form I-9 on day one. Work authorization under portability lasts until USCIS decides the petition, and if denied, the portability basis for employment ends. The guidance is drawn from 8 CFR 214.2(h) and USCIS publications.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Vercel Schedules Enters Public Beta as Successor to Cron Jobs

Vercel introduced Schedules on November 4, 2026 and moved it to public beta on November 5, 2026. It is positioned as the successor to Cron Jobs, which continue to run, and Vercel has published a migration guide without forcing a cutover. Schedules adds per-schedule IANA time zones, private function targets, runtime creation and cancellation via an SDK, CLI, or API, and toggling without redeploying. Paid usage is metered, and migration mainly involves reshaping vercel.json, with the key pitfall being that path schedules default to POST rather than GET. Developers are warned not to run crons and schedules for the same work simultaneously, as this can cause duplicate executions.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Detectar cortes de escena con ffmpeg y dividir un vídeo en esos puntos

Una guía explica cómo localizar los cortes de un vídeo editado usando ffmpeg, yendo más allá del filtro básico habitual. El autor señala que showinfo escribe en stderr y no en stdout, un detalle que suele confundir a quien programa la detección. Se usa como ejemplo un resumen público del lanzamiento de la misión Artemis II de la NASA, de 92 segundos y 19 planos. Con el umbral por defecto de la aplicación, 0,27, se identifican 18 cortes en apenas 0,8 segundos de procesamiento. El texto también reconstruye en Python la puntuación de escena de ffmpeg a partir del plano de luma para entender cómo se calcula y cómo elegir el umbral.

0 comments Read more at DEV Community