THE COMPANY INDEX TRACKED BLOG
Ideas, decisions, and lessons from the team.
blog.filippo.io (opens on the source site)Passkey records are an interoperable format for WebAuthn credentials, similar to password hash strings. I propose a potential crypto/passkey Go API based on them.
Read at the sourceThere is no need to update symmetric key sizes as part of the post-quantum transition, due to the details of how Grover's algorithm scales. Most authorities agree.
Read at the sourceThe risk that cryptographically-relevant quantum computers materialize within the next few years is now high enough to be dispositive, unfortunately.
Read at the sourceI recommend turning Dependabot off and replacing it with a pair of scheduled GitHub Actions, one running govulncheck, and the other running CI against the latest version of your dependencies.
Read at the sourceCode hosts like GitHub don't necessarily show the correct source of Go modules. pkg.geomys.dev is a new convenient viewer for module source.
Read at the sourceWe apply a transparency log to a centralized keyserver step-by-step, in less than 500 lines, with privacy protections, anti-poisoning, and witness cosigning.
Read at the sourceI delivered my traditional Go Cryptography State of the Union talk at GopherCon US 2025 in New York. It goes into everything that happened at the intersection of Go and cryptography over the last year.
Read at the source