What Passkeys Are and Why They Are Safer Than Passwords

·1 views

Passkeys are a password-free authentication method built on asymmetric cryptography, where a private key stays on the user's device and only a public key is shared with the website. When logging in, the site sends a challenge that the device signs with the private key, and the site verifies it using the public key — no secret ever travels over the network. Unlike passwords, passkeys are cryptographically bound to the exact domain where they were created, making them inherently resistant to phishing and credential theft. The technology is based on the WebAuthn standard developed by the W3C and promoted by the FIDO Alliance, whose members include Google, Apple, Microsoft, and Yubico. Traditional passwords remain a leading cause of breaches worldwide due to reuse, phishing, and server-side leaks, problems that passkeys are specifically designed to eliminate.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds crash-capture tool after storage corruption bug resists all reproduction attempts

A developer testing NodeDB-Lite and PageDB, an embedded storage stack for local-first applications, encountered a persistent store corruption bug triggered by an authenticated-page read failure in a full-text search path. The application fell into a restart loop each time it reopened the damaged store, but the developer could not reproduce the corruption through unit tests, benchmarks, or direct stress testing. Despite fixing several unrelated bugs along the way, the corruption kept reappearing during normal use without any deterministic trigger sequence. The leading theory of freed-page reuse could not be confirmed because logs did not capture store state at the exact moment of failure, and errors were returned rather than panics. To break the deadlock, the developer built a minimal crash-capture recorder that preserved the corrupted store and surrounding error context at the detection site before any restart or cleanup could alter the evidence.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Agentic Ledger: Open Source Proxy Tool Tracks AI Agent Costs and Loops

A developer has released Agentic Ledger, an open source transparent proxy tool designed to monitor AI agent activity without requiring any code changes or SDKs. The tool sits between an AI agent and its LLM provider, recording every HTTP request and response, calculating real costs, and storing data locally in SQLite or Postgres. It includes loop detection to identify repetitive or stuck agent behavior, and can act as a circuit breaker by returning HTTP 429 errors to prevent runaway spending. Hard budget caps can be enforced per session, per agent, or per day before calls even reach the provider. The project is MIT licensed, available via pip or Docker, and the developer is actively seeking testers and contributors to expand its real-world coverage.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Can Build Your Test Framework Fast, But Your Team Still Owns the Chaos

AI tools like Claude can now generate browser test frameworks in hours, dramatically lowering the barrier to getting started with automation. However, the real challenge shifts from creation to long-term ownership, as generated systems often break at integration points such as fixtures, test data, and environment assumptions. Teams risk mistaking high output metrics — like test file counts or passing checks — for genuine quality coverage, while critical user journeys go untested. A 500-test AI-generated suite can provide less confidence than 40 carefully chosen scenarios targeting real business risks. Ultimately, teams that rely on AI-assembled toolchains become responsible for maintaining a complex, multi-component system that no single vendor supports.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Tool to Tally Nine Months of Ignored AI Attribution Data

A developer created rai-lint, a commit linter that blocks submissions lacking AI attribution footers, then spent nine months collecting data without ever analyzing it. The footers use standard Git trailer conventions already adopted by the Linux kernel, Fedora, and LLVM for tracking AI contributions. After realizing the structured data was sitting idle, the developer built a companion tool called rai-commit-badge to finally make use of it. The new GitHub Action reads attribution footers from git history, weights them by lines changed per commit, and publishes the results as a Shields.io badge in the project README. The project aims to bring transparency and auditability to AI-assisted code contributions using vocabulary the broader industry has already converged on.

0 comments Read more at DEV Community