How Passkeys Use Cryptography to Replace Passwords and Block Phishing

·1 views

Passkeys are a modern authentication standard built on WebAuthn and FIDO2 specifications that eliminate the use of shared secrets like passwords. Instead of transmitting a password, the system uses asymmetric cryptography: a private key stored securely on the user's device and a public key registered with the website. During login, the server issues a cryptographic challenge that the device signs with the private key, and the server verifies the signature using the stored public key. Because the private key is bound to a specific domain and never leaves the device unencrypted, passkeys are inherently resistant to phishing, credential stuffing, server breaches, and man-in-the-middle attacks. This origin-binding feature means even a convincing lookalike website cannot trick the authenticator into releasing credentials.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds LLM pricing API, finds AI agents are its most likely users

A developer created LLM Price Watch, an API that aggregates and compares per-token pricing across major AI models including Claude, GPT, Gemini, DeepSeek, and Grok. Beyond standard pricing endpoints, a recommendation endpoint was added that suggests the best model for a given use case — such as coding assistance or document summarization — based on both cost and editorial analysis. The developer noted that AI agents performing runtime tool selection, not just human developers, emerged as a core audience for the API. Design decisions like open CORS and no API key requirement were made deliberately to reduce friction for agent-based callers. Pricing data was verified directly against each provider's official pages to avoid the lag common in third-party aggregators.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Open-source audit reveals how 18 major sites secretly filter AI crawlers

A developer built an open-source tool called geo-crawl-audit to test how major websites treat AI web crawlers such as GPTBot, ClaudeBot, and PerplexityBot compared to regular browsers. Testing 18 prominent sites on August 7, the audit found that firewall configurations often contradict stated robots.txt policies, effectively making crawler access a business decision rather than a technical one. The New York Times, currently in litigation with OpenAI, blocked nearly all AI crawlers, while The Guardian, which holds a content deal with OpenAI, selectively allowed OpenAI bots but blocked Anthropic and Perplexity crawlers. Reddit's robots.txt disallows all AI bots, yet several were served live content anyway, exposing the gap between declared policy and actual enforcement. The audit also highlighted that most major AI crawlers do not execute JavaScript, meaning heavily client-rendered sites like LinkedIn and Reddit expose near-empty pages to crawlers regardless of access permissions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Docker Basics Explained: Images, Containers, Ports, and Volumes Demystified

Docker is a platform that packages applications along with their dependencies into isolated environments called containers, solving the common 'it works on my machine' problem. A Docker image is a read-only blueprint containing the application code, runtime, and configuration, while a container is a live, running instance created from that image. A single image can be used to spin up multiple containers simultaneously, making applications highly portable and scalable. Port mapping bridges the gap between a container's internal network and the host machine, allowing external access using the syntax -p HOST_PORT:CONTAINER_PORT. Understanding these four core concepts — images, containers, ports, and volumes — forms the foundation needed to work effectively with Docker.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

WanderWallet: A Fully Offline Travel Budget App Built in .NET MAUI Without Any Backend

Horizon Software, a solo Android developer, has built WanderWallet, a travel budgeting app that operates entirely on-device with no backend, cloud services, or user account required. The app stores all data in a local SQLite database and handles currency conversion by caching exchange rates for around 155 currencies whenever a connection is available, freezing each rate at the time of expense entry to prevent historical budget drift. Receipt scanning uses on-device OCR via ML Kit through Plugin.Maui.OCR, with a custom text parser extracting amounts, dates, and merchant names without sending data to any external server. Trip mapping is achieved by rendering a bundled Creative Commons world image using a plate carrée projection rather than relying on a tile-streaming mapping SDK. The project demonstrates that features commonly assumed to require server infrastructure — currency conversion, OCR, and maps — can be fully implemented offline with careful architectural choices.

0 comments Read more at DEV Community