Tag Archives: Kcdc

[kcdc 2025] Passkeys: The end of Passwords and the Future of Authentication

Posted on by
Reply

Speaker: Mateusz Zajac

For more see the table of contents

General

  • Don’t need complex passwords
  • Phishing proof
  • Public key crypto _ biometrics
  • One tap sign in
  • Secure
  • Fewer breaches
  • Simpler flows
  • Lower support costs – fewer password resets/tickets
  • Lower fraud – starting to move to customer facing apps like travel. Not just finance
  • 1 billion people use daily

Problems with passwords

  • Easy to guess/steal
  • Phishing
  • Credential stuffing – if one account falls, others follow
  • Server breaches. Most common attack
  • Users have to keep track

Passwords vs Passkeys

  • Passkeys auto generates. Passwords type twice.
  • Passkeys can use face id
  • Passkeys don’t require reset. Password reset flow has many steps. Including memorable but different than last batch of passwords. 57% users forgot password after reseting. 30-40% help desk calls password reset related
  • 81% breaches involve compromised credentials
  • 51% of people reuse password
  • 2.5 million passwords stolen each week
  • Passkeys synced via iCloud
  • 92% users give up and don’t try to reset
  • 400 million google accounts use

2FA

  • SMS phishable
  • Push fatigue where keep getting notification until give in and click

Passkey

  • Pair of keys
  • Private key on your device
  • Private key kept safe
  • Phone creates a sharing key
  • Website sends challenge need secret key to solve
  • Use face id and solves
  • Sign ins are four times faster than passwords

Amazon login example

  • One time setup – your device creates a private/public key pair. Amazon stores public key
  • When try to login, Amazon sends a cryptographic challenge. This avoids replay attacks.
  • Your phone uses Face ID to confirm it is you. Then phone has private key sign the challenge and sends to Amazon. Amazon authenticates

Phishing prevention

  • Scammer tries with fake sight
  • Your phone refuses to sign because domain is wrong

iOS Code

  • WebAuthn
  • FIDO2 – gets url, challenge size, etc

Cross Device Sign in

  • Websitte generates QR code
  • Scan with phone. Uses bluetooth to verify physical proximity
  • Single use
  • Expires quickly
  • Private key never leaves device
  • Useful if want to log in from someone else’s computer

Challenge

  • If lose phone
  • Cross platform sync
  • Inconsistent browser support
  • Human factors – trust, education

Good references

  • w3c.org/TR/webauthn
  • fidoalliance.org
  • developer.apple.com/passkeys
  • etc

Informal Q&A

  • Two people had facial recognition not work
  • External device

My take

Great comparison and great statistics.

[kcdc 2025] The Amazing Features of Modern Java

Posted on by
Reply

Speaker: Venkat Subramaniam

For more see the table of contents

Switch

  • Showed switch with break missing
  • Turned it into a switch expression by changing the code in place.
  • Emphasized code more concise and not writing extra break
  • Can match multiple values
  • Can add {} and multiple lines of code with yield. Not recommended. [so glad he said not recommended}.
  • If use return instead of yield, compiler tells you what is wrong “attempt to return out of a switch expression” instead of what to do. [fun analogy about inlaws telling you what is wrong]

[i had more notes than this – record and sealed classes – i messed up saving]

My take

I missed some of this because I was getting ready for my session immediately after this. I’ve seen Venkat speak many times and am familiar with the content. I came mainly because Venkat is an amazing speaker and has great energy.

[kcdc 2025] Vibe Coding Revolution: How AI Assisted Development Tools are Transforming Velocity

Posted on by
1

Speaker: Tony Galati

For more see the table of contents

Intro

  • A Product Owner (Alex) at NAIC (National Association of Insurance Commissioners) gave the background of their project.
  • Origin: Gave a prompt for the backend/infrastructure and have Cursor generate the draw.io. Included Okta, Docker, etc. Showed the prompt. It’s about 20 lines and pretty detailed
  • Used prompts to make a front end prototype. PO iterated on it.
  • Then Tony spent about 2 days connecting them.
  • After that, they did a two day hackathon because knew could get something up quickly
  • At hackathon 1, learned need to have business problem, implementation plan and business support. Did two business days (9-4 each day)
  • Doing second hackathon next week.
  • Did daily standup at hackathon
  • Made sure had everything needed like Okta in advance of hackathon

Business benefits

  • Can generate use cases
  • If want specific format say it
  • AI rewrote his one sentence prompt to include depth needed
  • Got Next.jS front end prototype.
  • Business can iterate with prototype independently
  • Showed user stories generated
  • Even if don’t download code, will speed up time for business analyst
  • Figma.AI doesn’t let you change with prompts after initial generation. V0 lets iterate.

Back end

  • Switched speaker to Tony – Enterprise Architect
  • Absolutely not production ready, but could show working
  • Can specify to AI tool what coding standards to follow, needs to work on all devices, etc
  • Used Amazon Q first. Then started using Cursor
  • V0 is good for live changes in front of customer.

Before Hackathon

  • Engaged security and legal. AI acts on behalf of user so has user permissions.
  • Went through what the models were trained on: https://trust.cursor.com
  • Elaborated on AI policy. He did a show of hands and about 2/3 of the audience has an AI policy at work
  • Defined intellectual property allowed to be used in Hackathon. Could have called it a POC.
  • No PII data
  • Once commit code to Git, normal software development lifecycle.
  • Security engineer paired with developers to understand what Cursor can do
  • Setup Cursor IDE Project Rules – written in plain English. Had AI write it and human proofread. Can be context specific so can say some rules only apply when you say “commit” or other scenarios
  • Setup memory bank – includes extra info/tasks
  • Setup pipelines and quality gates
  • Wrote team prep instructions. Keep it short
  • Wrote down the tech stack. Team implementing used Angular so agreed to let Cursor translate.

Future

  • Roll out Cursor
  • Second hackathon
  • Smaller consumable guide/instructions
  • Mandatory walkthru sessions including BFF (backend for front end) pattern
  • Three days instead of two. This time using a language they aren’t familiar with instead of Angular.
  • AI first behavior – AI does a lot – ex: write tasks for AI consumption but human readable, our job will change towards steering AI. Have AI do one step at a time
  • No training because changes so fast. Instead pick champions and three day immersion
  • Buy things a year at a time since change so fast

Further future

  • AI code reviews.
  • Have multiple agents fix a defect and primary recommend what best
  • Future problem – new people won’t know codebase. Already have that problem and have to figure it out but won’t be worse. Will be catastrophic failures.

Key takeaways

  • Encourage staff to use AI – even at home. You need to fix the toilet, use AI
  • Start POCs
  • Visuals sell
  • AI is coming. Need to figure out how our jobs will change

My take

The speaker on stage was wearing a suit which made me nervous this wasn’t going to be technical. But he quickly said he was going to give an overview and turn it to Tony. Tony is wearing sneakers and jeans which is in keeping with what the hands on folks wear to conferences like this. The speaker in the suit asked how many people from the business side were in the audience. He made a joke that was that he expected when their were crickets. The information in both halves of the presentation was great. Excellent end oot the day. I’m glad the conference organizers gave them a big room! I also like that it was a realistic description and not “see AI is magic and does everything by itself”