Tommaso Gagliardoni

"Passkeys Are Not a Trap"? Nice Try Scott Helme, founder and CEO of a company that markets a "Passkeys Protection" offering.

https://scotthelme.co.uk/passkeys-are-not-a-trap/

Sorry, your article is patronizing me about what attestation is, then explaining that passkeys today don't give websites an attestation at all - though a site can ask. And in so doing, it completely fails to address the main criticism of the "Passkeys are a trap" blog post, i.e. that passkeys are the boiling frog of BigTech control on authentication.

https://nonfunctional.substack.com/p/passkeys-are-a-trap-do-not-use-them

The only point I concede is that TOTP are vulnerable to phishing. And yet, if I really have to choose, I prefer that risk rather than handing over control to Google, Apple, and co. In any case, hardware authenticators like Yubikey / NitroKey are the preferred solution.

Sorry, not convinced. Passkeys are a trap. Do not use them.

#passkeys #security #cybersecurity #bigtech #google #apple #enshittification #bigtech #digitalsovereignty #opensource #infosec #passwords #phishing #totp

Wow, this is crazy IF TRUE: apparently a batch of Ledger hardware crypto wallets was compromised with a malicious hardware implant that was exfiltrating user's keys and draining funds:

https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/

After the Mossad's bomb pagers story it is clear that supply chain attacks are not tinfoil hat paranoia anymore, but damn, this is insane:

According to Karpelès, the malicious hardware captured the device's display output and button presses to identify the seed phrase, then transmitted it to the attacker over an LTE connection using an eSIM.

Now, a reminder is obligatory, that this guy is not the most... trustworthy source of information. But this time the story seems to match what reported by other users and by Ledger themselves.

#crypto #web3 #ledger #bitcoin #supplychain #hacking #cybersecurity #infosec #paranoia #backdoor

And this is what I was worried about:

https://arxiv.org/pdf/2610.13928

constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights

I had already pointed out how "open weights" is not enough guarantee for AI models: https://gagliardoni.net/#20260208_euria

Now, this new research makes things even worse. I think most of us tech folks will have to reassess carefully our own relationship with AI. To put it in easy words: at this point I don't think any of us is smart or creative enough to predict all threats that can come from this technology.

#ai #cryptography #backdoor #alignment #llm #security #opensource #infosec #cybersecurity

Oh great, just what I needed:

https://www.reuters.com/business/ai-models-may-soon-self-replicate-without-access-data-centers-anthropic-warns-2026-10-13/

Anthropic said on Monday its experiments suggested small AI models may be months away from being capable enough to ​self-replicate on commercial internet-of-things (IoT) devices

I mean, Anthropic (and OpenAI) are on this mission to convince everyone that AI is Dangerous and that they are the only ones who can handle this Big Responsibility properly. And this implies scaring the shit out of everyone.

Despite this, I think there are real, concrete risks in this technology, that so far we have only imagined in sci-fi novels, and new ones that nobody has figured out yet.

Rejecting AI out of Luddism won't work. But we, as a species, should thread very, very carefully on this.

#ai #anthropic #openai #bigtech #skynet #doom #humanity