Join 5,000+ subscribers getting weekly tips on web development, mobile apps, and AI solutions.
HOSTSPICA RESEARCH
Engineering write-ups, R&D notes and guides for HostSpica Authenticator, Passkey and Identity. Every claim comes with a way to check it, and every page says what the product does not protect against.
LATEST · PAGE 3 OF 4
A passkey is not an app you download. What people mean by passkey download, which apps and built-in tools can hold passkeys, and how to avoid fake apps.
ReadHow passkeys work with a Google Account, where they can be saved, and how a local passkey provider such as HostSpica Identity differs from Google Password Manager.
ReadWhat happens when you sign in with a passkey: the challenge, your biometric, why a fake site fails, what to do if the passkey is not offered, and how to sign in on a computer.
ReadHow Apple passkeys work with iCloud Keychain, what you cannot move to Android, how to sign in to a site on a PC or Android phone with an iPhone passkey, and the alternatives.
ReadWhat the QR code on a computer sign-in page is, who does the scanning, why a passkey app does not need its own scanner, and what to do when scanning does nothing.
ReadWhere passkeys are listed for Google, Amazon and on your phone, how to remove or replace one, and how HostSpica Identity shows and deletes its own passkeys.
ReadStep by step: turn on HostSpica Identity as a passkey provider on Android 14 or newer, create a passkey for your Google Account, test it and keep your account recoverable.
ReadAn Android app needs the INTERNET permission to reach the network. Here is how to confirm an app does not declare it, what that does and does not guarantee, and what we found in HostSpica Identity 1.0.0.
ReadA step-by-step walk through RFC 6238 time-based one-time passwords, the exact algorithm HostSpica Authenticator runs on your phone, the test vectors you can check it against, and where TOTP stops protecting you.
ReadWhat is inside the otpauth-migration QR code that Google Authenticator shows when you export accounts, how HostSpica Authenticator reads and writes it, and why exports are split into pages of at most 10 accounts.
ReadHOW WE WRITE