Damian’s notes

• 
  Kobold letters – Lutra Security Anyone who has had to deal with HTML emails on a technical level has probably reached the point where they wanted to quit their job or just set fire to all the mail clients due to their inconsistent implementations. But HTML emails are not just a source of frustration, they can also be a serious security risk.

(Via Ricky Mondello on Twitter)

• 
  What's New in Authentication - WWDC 2019 - Videos - Apple Developer Secure sign-in and authentication is a key feature of a secure account-based app design. Learn how you can improve your app's login...

• ';--have i been pwned? Check if you have an account that has been compromised in a data breach

• Web Authentication: An API for accessing Public Key Credentials Level 1 Abstract This specification defines an API enabling the creation and use of strong, attested, scoped, public key-based credentials by web applications, for the purpose of strongly authenticating users. Conceptually, one or more public key credentials, each scoped to a given WebAuthn Relying Party, are created by and bound to authenticators as requested by the web application. The user agent mediates access to authenticators and their public key credentials in order to preserve user privacy. Authenticators are responsible for ensuring that no operation is performed without user consent. Authenticators provide cryptographic proof of their properties to Relying Parties via attestation. This specification also describes the functional model for WebAuthn conformant authenticators, including their signature and attestation functionality.