dchest.com

Dmitry Chestnykh's blog about tools, online business, technology, programming, and life.

json

Open the feed

https://dchest.com/feed.json

Last post: Aug 9, 2025
Posts in 24 h · 7 days · 30 days: 0 · 0 · 0
Our last check: Answering
Served from: United States
Text score at discovery: 3,677
Format: json

Posts

What our queue read from this feed. Open one to read it here, or go to the site that published it.

ML-KEM in WebCrypto API
Aug 9, 2025 · original
Web Cryptography API is not everyone s favorite thing, but it s the only way to do cryptography client-side in web browsers or web views if you want to avoid third-party libraries (e.g., for compliance reasons, or to save keys securely in IndexedDB ). Only recently have we gotten wide X25519 and Ed25519 support in browsers. The next big thing is ML-KEM , a post-quantum key encapsulation mechanism standardized by NIST last year. ML-KEM protects against future quantum computers that could break current public key algorithms. Implementing it now is important for many use cases, because attackers can record data encrypted with classical algorithms today and decrypt it later when quantum computers that can break those algorithms become available ( if this ever happens ). Implementing quantum-secure signatures, such as ML-DSA and SLH-DSA, on the other hand, is less pressing for many applicatio
How to store web app data in the system keychain
Jun 17, 2025 · original
While there are no APIs to store web app data in the system keychain, there is a simple method that allows you do almost the same thing using WebCrypto API. This also applies to native apps that use WKWebView. Step 1 Generate a non-extractable AES CryptoKey using window.crypto.subtle.generateKey : const key = await window.crypto.subtle.generateKey( { name: "AES-GCM", length: 256, }, false, // non-extractable flag, important! ["encrypt", "decrypt"] ); Step 2 Save this key into IndexedDB . Step 3 Use this key to encrypt and decrypt data that you want to be tied to the keychain, for example, using AES-GCM with a random nonce : async function encrypt(data: Uint8Array): PromiseUint8Array { // Retrieve the key from IndexedDB (implement this yourself). const key = await getEncryptionKey(); // Generate a random nonce. const iv = window.crypto.getRandomValues(new Uint8Array(12)); // Encrypt the d
Blurring is not enough
Jul 9, 2020 · original
You’ve probably heard of that thing that restored (well, tried to restore) pixelated images. You may have heard about the criminal who got caught after he posted a swirled photo of himself. Police was able to undo the deformation to reveal his face. Turns out, blurring can also be undone in some cases: This is the result of Restoration of defocused and blurred images project by Vladimir Yuzhikov. Of course, it won’t magically unblur any photo, but the results are impressive nonetheless. If you want to make something unrecognizable in a photo, just slap a big black rectangle on top. Make sure that the rectangle is opaque. Then take a screenshot of the censored image just to be safe and use it. To be completely sure, print and scan it back if you’re paranoid! Make sure your printer or scanner drivers don’t send pictures somewhere. Ah, screw it, just don’t post the picture! * * * See also t
SwiftUI is the future
Jul 8, 2020 · original
SwiftUI is Apple’s UI framework, which is quite similar to React . It lives on top of their other UI frameworks: you declare components, state, and some callbacks, and the system will figure out how to render everything. It was announced last year. This year Apple improved it, added many missing features, and began using it for new widgets, Apple Watch complications, etc. SwiftUI code sample from Apple. What’s interesting is that Apple is clearly going for the ease of cross-platform development. With the same UI code base, the same components adjust their behavior according to the target platform: watchOS, iOS, iPadOS, macOS, and tvOS. (glassOS in the future?) In The WWDC 2020 Talk Show Craig Federighi said that they are not declaring a single framework a winner for the future, everyone can continue using UIKit and AppKit. This makes sense — for now — since you can do things with them th
Platform authenticators for Web Authentication in Safari 14
Jun 27, 2020 · original
Safari 14 will support platform authenticators for Web Authentication API (also known as WebAuthn). Current versions of Safari already support WebAuthn for security keys, such as YubiKey , which are called roaming authenticators , but soon you will be able to authenticate using Touch or Face ID on supported devices without any external keys; this is called a platform authenticator . This is already supported by Chrome on Macs, but the importance of the new development is that millions of iOS and iPadOS users will be able to use WebAuthn without dongles. Here’s how it works, briefly. You sign up normally with username and password, and then add your device (iPhone, iPad, MacBook with Touch ID) for passwordless log in. The next time you sign in, you don’t even have to enter your password — your device will ask you for your fingerprint or face, and you’re in. Since the cryptographic keys us
Does salt need to be random for password hashing?
Jun 15, 2020 · original
You probably know that salting is needed to make each password hash unique so that an attacker couldn’t crack multiple hashes at once. This was already known to the Unix creators, according to the paper written by Robert Morris and Ken Thompson in 1979: 3. Salted Passwords The key search technique is still likely to turn up a few passwords when it is used on a large collection of passwords, and it seemed wise to make this task as difficult as possible. To this end, when a password is first entered, the password program obtains a 12-bit random number (by reading the real-time clock) and appends this to the password typed in by the user. The concatenated string is encrypted and both the 12-bit random quantity (called the salt ) and the 64-bit result of the encryption are entered into the password file. When the user later logs in to the system, the 12-bit quantity is extracted from the pas
Improving storage of password-encrypted secrets in end-to-end encrypted apps
May 25, 2020 · original
Many apps with client-side encryption that use passwords derive both encryption and server authentication keys from them. One such example is Bitwarden , a cross-platform password manager. It uses PBKDF2-HMAC-SHA-256 with 100,000 rounds to derive an encryption key from a user’s master password, and an additional 1-round PBKDF2 to derive a server authentication key from that key. Bitwarden additionally hashes the authentication key on the server with 100,000-iteration PBKDF2 “for a total of 200,001 iterations by default”. In this post I’ll show you that these additional iterations for the server-side hashing are useless if the database is leaked, and the actual strength of the hashing is only as good as the client-side PBKDF2 iterations plus one HKDF and one HMAC. I will also show you how to fix this. (Note that this post is from 2020 and discusses Bitwarden s authentication scheme as it
Why password peppering in Devise library for Rails is not secure
May 19, 2020 · original
Devise is a popular authentication solution for Ruby on Rails. Most web apps need some kind of authentication system for user accounts and Devise allows adding one with just a few lines of code. This is great for security — if all the developers need to do is to plug a third-party library, there are fewer chances to make a mistake. This, however, requires that the library itself is implemented correctly, which is, unfortunately, not the case for many of them. Peppering is a technique for making password hashes useless without a secret key. It helps prevent a class of attacks where attackers get read-only access to the database (for example, via an SQL injection or a leaked backup dump), but don’t have access to the app server, where the secret key is stored. With peppering, it would be infeasible for attackers to perform a dictionary attack on leaked password hashes, because they don’t k
My book on password authentication is out
May 15, 2020 · original
I’m super excited to announce that my book, Password authentication for web and mobile apps , is out! I have a lot more to say about why I decided to write it and what the writing and publishing process was in future blog posts. Meanwhile, if you’re a developer who wants to understand password authentication and implement it for your web site or your app, please check it out: https://dchest.com/authbook/
How to use Chrome securely
Jan 16, 2019 · original
Install uBlock Origin extension. (If you’re not from US, check its options to turn on ad block lists for your country) Do not install any other extensions ever! (exceptions: 1Password, Google Arts & Culture ). Create separate “people” for different activities: e.g. home, work, browsing sketchy websites. (Click on avatar → Manage People.) If you want to turn on sync, set up encryption passphrase. It’s a separate passphrase from your Google account — your sync data will be encrypted locally with it before hitting Google servers. Disable saving/auto fill of passwords, payment, and addresses. ( https://twitter.com/Sc00bzT/status/1085521985017466881 ) That is all (for now).

Discovered by the rss-feed-index crawler, which checks each feed at most once a month.

Same record as JSON: https://api.agentalog.com/api/feeds/fd_dchest_com_2bb421673a18b627. More from this site: dchest.com in the Feeds tab.