2026-10-30T09:22:46Z https://nostr.now Scott Helme https://nostr.now/npub1xqlu80ajfs5qapw8dj8sfatczmdzeu2rkj8seeyzqjxx54zn9y3sqjayrn https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/299/071/324/225/541/original/51f67da3cb4719f7.jpeg https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/299/071/324/225/541/original/51f67da3cb4719f7.jpeg https://nostr.now/nevent1qqsy5m67ch3uqyt2yxcu6nv0vl6zh4dsjccax7te6fxu7rt890tu3mszyqcrlsalkfxzsr59cakg7p840qtd5t83gw6g7r8ysgzgc6j52v5jxw90zus -----BEGIN EC PRIVATE KEY-----<br/>4<br/>-----END EC PRIVATE KEY-----<br/><br/>😬<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/480/019/317/538/176/original/1922088fd5a3088e.png"> <br/> 2026-10-21T17:13:55Z https://nostr.now/nevent1qqsqk5auaz04zqlkpjx8kcefpsylhk7eel8xvmj7xwd93087044kuagzyqcrlsalkfxzsr59cakg7p840qtd5t83gw6g7r8ysgzgc6j52v5jx0a7em7 Quite a few people have sent me the &#34;Passkeys are a trap. Do not use them.&#34; post on Substack.<br/><br/>The post recommends people abandon passkeys and stick to passwords + TOTP, citing what appears to be concerns with attestation as the primary reason.<br/><br/>I’ve written a rebuttal as this is really dangerous advice and it&#39;s based on some incorrect technical claims.<br/><br/><a href="https://scotthelme.co.uk/passkeys-are-not-a-trap/">https://scotthelme.co.uk/passkeys-are-not-a-trap/</a> 2026-10-14T09:25:23Z https://nostr.now/nevent1qqswzaw3p2esdemfm4newyz3qc6ngyx69pkjm77yz9k6wd46uxmvezszyqcrlsalkfxzsr59cakg7p840qtd5t83gw6g7r8ysgzgc6j52v5jxd6tpxr They exposed data on 8.8 million people with no exploit, no malware, and no access to MAG’s servers.<br/><br/>Three server-side API keys sat in public JavaScript for 4+ years and FulcrumSec found them. They could have modified and deleted data too. <br/><br/>I verified how the Manchester Airports Group breach happened:<br/><br/><a href="https://scotthelme.co.uk/no-hacking-required-manchester-airports-group-data-breach/">https://scotthelme.co.uk/no-hacking-required-manchester-airports-group-data-breach/</a> 2026-09-07T09:20:45Z