Matthew Miller

How many WebAuthn library downloads a month?! A quick SimpleWebAuthn and py_webauthn popularity check vis-a-vis number of downloads over the last 30 days.

New blog post just dropped 📝🎉

How many WebAuthn library downloads a month?!

blog.millerti.me/2026/02/28/h...

Screenshot of what's apparently supposed to be a "git flow" chart from Microsoft learning materials. It's full of bizarre spelling errors and fucked up diagram elements that make it pretty clear the thing was AI generated.

oh.... my god??

actual chart from learn.microsoft.com/en-us/traini... btw

Hmm, I've never encountered such a need for credential ID introspection. An RP shouldn't need to care about credential ID length - it's essentially a random value for the purposes of storing it from and passing it into WebAuthn API calls. SimpleWebAuthn certainly doesn't require the introspection 🤔

I noticed that the credential ID returned from verifyRegistrationResponse() isn't being used when saving the cred to the DB. Did you already catch and fix that? I wonder if that's contributing to the difficulties in using the cred for auth afterwards...?

Twitch chat integration when

Can I interest you in WebAuthn's Virtual Authenticator browser automation API? It's great for setting up automated end-to-end front end tests if you're running them in an actual browser. It automates the user's interaction with WebAuthn's modals w3c.github.io/webauthn/#sc...

Gotta get the timeline back to fun video game and programming stuff. I can lean on my RSS setup to keep up with (filtered, non-real-time) current events.

I had to make a "Politics" list and move some follows over to it because my Following timeline has not been good for my mental health. To the point my wife is concerned that I seem tired or depressed all the time...this also happened to me in 2017. Gotta dial it back like I had to back then too 🫠

A macOS file transfer dialog shows that the Affinity application being copied to the Applications directory is 3.5GB in size.

Affinity is still absolutely massive - download a 980MB file into an uncompressed 3.5GB executable 😵

Holy smokes, Affinity Photo, Designer, and Publisher are all now just a single app, and it's FREE? This is seriously great news, it might get me to switch back from Pixelmator Pro 🤔

Encrypting Data in the Browser Using WebAuthn My sneakernet hacker fantasies are becoming reality 👟

And I recently updated my two-year-old PRF blog post to add a header that discourages naive use of PRF blog.millerti.me/2023/01/22/e...

I intentionally don't make PRF simple to use and never will simplewebauthn.dev/docs/advance...

This is why a small contingent of us have been politely discouraging people to use PRF, because of that footgun in particular.

To be fair to some credential managers, I think they've come around and are trying to use PRF to encrypt an unlock token for local access, not E2EE of the entire vault 🤔

Another slam dunk campaign slogan the Democrats will absolutely not capitalize on

I know it’s too much to expect them to know their history, but if the American Revolution had a motto, it definitely would not have been “immigrants go home.”

It would have been “get your fucking soldiers out of our cities.”

Passkey Mythbusters: Short Takes on Common Misunderstandings @ Authenticate 2025 Passkeys promise to replace passwords with a simpler, more secure login experience, but myths and confusion still hold many organizations back. This session at Authenticate 2025 tacklea some commonly ...

At Authenticate, @iamkale.millerti.me, @nishantkaushik.com, and I decided to mix up the usual "Passkeys 101" and cover common misconceptions about #passkeys. Topics around cloud sync, phishing resistance, workforce usage, and concerns about vendor lock in.

blog.timcappalli.me/p/preso-auth...

My shitposting did not contribute to his arrival therefore I will be deemed unworthy

Hey my dude, I'm the guy who made the library and I think it's okay to make mistakes so long as you learned something new from it. Think of it this way: now you know why LLMs are wrong when they suggest that WebAuthn should support optional mediation!

Good luck on whatever you're working on 😌

No Man's Sky Breach Trailer www.youtube.com/watch?v=eNaY...

Patch notes www.nomanssky.com/2025/10/expe...

Office IT is infuriated by my script that makes everyone's Yubikey print out the entire script of the Bee Movie (2007)

That Kid Pix shirt 👨‍🍳 💋

Here lies Matt Miller. Cause of death: Roko's Basilisk

people in Portland are taking down ICE with what looks like a party from Chrono Trigger

A screenshot of the mlf.lol playground, displaying an example of ATProto lexicon generation from a source MLF file. The MLF source uses inline types, def types, tokens, records, constraints, references, and references to a "standard library." Thematically, the source refers to posters on an old school forum.

The more I play with this, the more I love it.

Even if I'm the only one using mlf.lol to generate #atproto lexicons, it has been worth it. It really hits the pleasure centers of my brain just right.

RIFs can’t be done without agency leadership so this is RFK Jr extending his purge of CDC scientists to help Vought’s shutdown agenda. Genuine public health risks created by aggrieved men.

you've met antifa, now say hello to antif-rog 🐸

I'm a library maintainer that publishes to both now. I'll continue publishing both because I want to target as much of Node, Deno, CF Workers, etc... as I can, and NPM may never get native JSR support.

I think if I wrote something specifically for Deno I'd simply publish to JSR for how easy it is 🤔

Yo wtf

"Hey MattGPT, what can you tell me about <thing>?"

"As a Large, Livid Man..."

Geezus, what a headline. RIP NPR