Web Cryptography API is not everyone’s favorite thing, but it’s the only way to do cryptography client-side in web browsers or web views if you want to avoid third-party libraries (e.g., for compliance reasons, or to save keys securely in IndexedDB ). 

 Only recently have we gotten wide X25519 and Ed25519 support in browsers. 

 The next big thing is ML-KEM , a…
While there are no APIs to store web app data in the system keychain, there is a simple method that allows you do almost the same thing using WebCrypto API. This also applies to native apps that use WKWebView. 

 Step 1 

 Generate a non-extractable AES CryptoKey using window.crypto.subtle.generateKey : 

 const key = await window.crypto.subtle.generateKey(
 {
…
You’ve probably heard of that thing that restored (well, tried to restore) pixelated images. 

 

 You may have heard about the criminal who got caught after he posted a swirled photo of himself. Police was able to undo the deformation to reveal his face. 

 

 Turns out, blurring can also be undone in some cases: 

 

 This is the result of…
SwiftUI is Apple’s UI framework, which is quite similar to React . It lives on top of their other UI frameworks: you declare components, state, and some callbacks, and the system will figure out how to render everything. It was announced last year. This year Apple improved it, added many missing features, and began using it for new widgets, Apple Watch complications, etc. 

 

…
Safari 14 will support platform authenticators for Web Authentication API (also known as WebAuthn). Current versions of Safari already support WebAuthn for security keys, such as YubiKey , which are called roaming authenticators , but soon you will be able to authenticate using Touch or Face ID on supported devices without any external keys; this is called a platform authenticator . 

…
You probably know that salting is needed to make each password hash unique so that an attacker couldn’t crack multiple hashes at once. 

 This was already known to the Unix creators, according to the paper written by Robert Morris and Ken Thompson in 1979: 

 
 3. Salted Passwords 

 The key search technique is still likely to turn up a
few passwords when it is used…
Many apps with client-side encryption that use passwords derive both encryption and server authentication keys from them. 

 One such example is Bitwarden , a cross-platform password manager. It uses PBKDF2-HMAC-SHA-256 with 100,000 rounds to derive an encryption key from a user’s master password, and an additional 1-round PBKDF2 to derive a server authentication key from that key.…


 Devise is a popular authentication solution for Ruby on Rails. Most web apps need some kind of authentication system for user accounts and Devise allows adding one with just a few lines of code. This is great for security — if all the developers need to do is to plug a third-party library, there are fewer chances to make a mistake. This, however, requires that the library itself is…


 I’m super excited to announce that my book, Password authentication for web and mobile apps , is out! I have a lot more to say about why I decided to write it and what the writing and publishing process was in future blog posts. Meanwhile, if you’re a developer who wants to understand password authentication and implement it for your web site or your app, please check it out:…

 Install uBlock Origin extension. (If you’re not from US, check its options to turn on ad block lists for your country) 
 Do not install any other extensions ever! (exceptions: 1Password, Google Arts & Culture ). 
 Create separate “people” for different activities: e.g. home, work, browsing sketchy websites. (Click on avatar → Manage People.) 
 If you want to turn on sync, set up…