DBSC is now available on Chrome for Windows.

Device Bound Session Credentials (DBSC) is a proposed standard that helps mitigate cookie theft by cryptographically binding a session to the user's device at the time of issuance. We've been testing DBSC for a while, but it's finally shipped in Chrome for Windows.

Announcement blog post: https://developer.chrome.com/blog/dbsc-windows-announcement
How to implement DBSC: https://developer.chrome.com/docs/web-platform/device-bound-session-credentials

A deep dive into the very basic concept of #passkeys — RP ID (Relying Party ID)

How to determine a suitable RP ID for your service
What if you have multiple domains
RP ID for apps
https://web.dev/articles/webauthn-rp-id

I made a Chrome Extension that allows you to debug #passkeys.

When implementing passkeys yourself or investigating how passkeys work on another website, setting up a debugger to capture requests and responses or parsing binaries to read the contents is not easy. Use "WebAuthn DevTools" to easily do that on Chrome DevTools panel.

Learn more: https://blog.agektmr.com/en/2026/01/webauthn-devtools.html

Signal API for passkeys is now available on Chrome for Android.

A user deletes their credential on the website, but the passkey remains in their passkey provider. The next time they try to sign in, the passkey provider offers a passkey that no longer works. A sign-in attempt will surely fail and this is such a bad experience.

The Signal API solves this by allowing your website to "signal" the current state of credentials to the passkey provider. You can tell the provider to delete invalid passkeys or update metadata, ensuring a seamless sign-in experience.

Learn more: https://developer.chrome.com/blog/signal-api-android

Capturing the overview of passkeys is difficult, especially if you are chasing updates. I wrote a personal blog post that captures an end of 2025 version of passkey keywords so you know what to learn.

Key terminologies to get a grasp of passkeys
https://blog.agektmr.com/en/2025/12/passkey-keywords.html

RE: https://infosec.exchange/@agektmr/115245262164960496

I'm in SYD to give this talk at Web Directions Developer Summit. See you there.