Eiji Kitamura / えーじ

web.devSecure and seamless passkeys: A deployment checklist | Articles | web.devA checklist for developers to make sure their passkey implementations are following all the best practices.

6 June 2025

Building a passkey system might seem straightforward, but making a *great* passkey system involves a few extra steps. Take a look at this passkey deployment checklist to see if you can enhance your implementation: web.dev/articles/pas...

Eiji Kitamura / えーじ reposted

💫 T.Katsumi@Bluesky

@tkatsumi06blue.bsky.social

15h

世界中で話題になっているこの動画。やはり機械翻訳には任せられないし、当のアメリカ国民や、他の民主国の人びとに「アメリカ史に遺る最も重要な動画の一つ」と言わしめる動画なので、自分の言葉で訳し、伝えたいと思い、作業しました。敢えてクレジットは入れていないので、ご自由に利用ください。Xではダウンロードも可能です。彼女の発言は3つの聴衆に向けられており、一つは取材者に対して（ここは敬語に）。もう一つはアメリカの為政者たちに対して（ここは常体に）。そして、もう一つはアメリカ国民に対して向けられていました（これも常体に）。それぞれ違いが伝われば幸いです。

The Digital Credentials API for credential issuance is now enabled by default in Chrome 155, allowing websites to issue digital IDs directly to mobile wallet apps without flags or origin trials.

With standard navigator.credentials.create() and OpenID4VCI, Android Credential Manager presents compatible wallets for the user to choose. It supports both same-device flows on Android and cross-device flows via QR code and Bluetooth proximity verification from desktop.

developer.chrome.comDigital Credentials API issuance ships in Chrome 155 | Blog | Chrome for DevelopersStarting from Chrome 155, Digital Credentials API issuance is enabled by default. The API makes it easier for websites to provision digital credentials to the user's preferred wallet app.

You can also automate testing using CDP's virtual wallet behavior in Chrome 152+. Check out the full implementation guide, code samples, and demo resources here: developer.chrome.com/blog/digital...

The Digital Credentials API for credential issuance is now enabled by default in Chrome 155, allowing websites to issue digital IDs directly to mobile wallet apps without flags or origin trials.

Previously, pushing credentials like student IDs or licenses to wallets required custom URI schemes for every partner wallet app. This led to fragmented implementations and limited user choice.

The Email Verification origin trial now supports Android in Chrome 154, plus third-party origin trials for embedded SDKs. It also brings compatibility updates like the `Sec-Fetch-Dest: email-verification` header and exact email casing (M156+). The trial is now extended through Chrome 160.

developer.chrome.comEmail verification updates, October 2026 | Blog | Chrome for DevelopersUpdates to the Email Verification origin trial, including Android support, third-party origin trials, optional kid handling, and Sec-Fetch-Dest header changes.

Dedicated guides for verifiers and issuers are also live—check them out if you're testing it: developer.chrome.com/blog/email-v...

たまにインスタでAI生成の面白コンテンツを見てるんだけど、コメント見てるとAI生成と気付いてなさそうなコメントが割と多くて、ちょっと心配してる。最近分かりにくくもなってきてるしな。

youtu.bemuque - いいんじゃない (ドラマ『南田南弁護士は天才肌』ver. Music Video)YouTube video by muque

ドラマの曲に使われるほど売れてしまった？けど、muque が Google I/Oのキーノートの動画に一瞬映ったのを俺は見逃さなかったぞ youtu.be/38zfe0cynJs

x.com47NEWS (@47news_official) on X外国人への差別的投稿が昨年同期比3倍増　三重県のモニタリング調査、4～6月 https://t.co/F7h6qp6dCq

Xで、差別投稿が三倍に増えたという趣旨の新聞記事に、差別するのはおかしくない、このクソ左翼自治体が、というリプライが付きまくっててマジで怖い x.com/47news_offic...

大きいカンファレンスの最後に同僚から、お前は一人で行動してるけど、なぜ他の日本人は（韓国人も）いつも一緒に固まってるんだ？と聞かれて、なんかドキッとしてしまった。俺はなるべく同僚といっしょに居るようにしてるんだけど、日本人と一緒に行動する方が楽だという自覚がある。これは国民性というか習性としか言い様がないし悪いこととも思わないけど、国際的なカンファレンスの場では西洋人からとっつきづらいと思われても仕方ないなとも思っている。

日本人は話す前に知り合う儀式をしなきゃいけないとか、シャイだからとか、英語に自信がないからとか言ってみたが、何なんだろうな。俺も相当頑張って社交性を発揮してるが、普通にしてたら知らない人に英語で積極的に話しかけるのは結構しんどい。外資系が多そうなここのフォロワーのみなさん、そこんとこどうなんですか？

Japan's national ID (My Number Card) is now officially available in Google Wallet on Android, joining Apple Wallet on iOS. Backed by an 80% adoption rate for the physical card nationwide, Japan's digital ID infrastructure is now natively accessible on virtually every smartphone.

This brings offline attribute verification into daily life. At university festivals, attendees can buy alcohol by proving they are 20+ via selective disclosure—without showing their name or address. At concerts, venues can verify identity at the gate to prevent ticket scalping.

services.digital.go.jp「Androidのマイナンバーカード」の提供を開始しました | Androidのマイナンバーカード（旧Androidスマホ用電子証明書搭載サービス） | デジタル庁ウェブサービス・アプリケーションAndroid端末に入れて利用できるマイナンバーカードです。Android端末ひとつで行政手続きや民間サービスへの申込ができます。

A national rollout uniting online biometrics and real-world selective disclosure across mobile wallets is a big milestone for digital identity. Official announcement from Japan's Digital Agency: services.digital.go.jp/mynumbercard...

Eiji Kitamura / えーじ reposted

Rowan Merewood

@rowan.fyi

Replying to @rowan.fyi

Additional instructions linked in the dedicated docs if needed and you can always ask me questions here 👋 https://developer.chrome.com/docs/identity/email-verification/verifier?hl=en#register_for_the_origin_trial

developer.chrome.comRelying party implementation | Identity | Chrome for DevelopersImplement the Email Verification API on your relying party site by updating your form markup and validating incoming SD-JWT+KB tokens on your server.

Eiji Kitamura / えーじ reposted

Rowan Merewood

@rowan.fyi

If you're testing the 📧 Email Verification origin trial in Chrome then you need to renew your origin trial token. We've extended the origin trial to Chrome 160, so head over to the Origin Trial site and click that Renew button! https://developer.chrome.com/origintrials/#/trials/my

developer.chrome.comOrigin TrialsChrome origin trials allow developers to safely experiment with web platform features

Did you know there's an easy way to streamline SMS OTP entry on your website?

web.devSMS OTP form best practices | web.devAsking a user to provide a one-time password is a common way to confirm a user's identity. Learn best practices to build an SMS OTP form, with great user experience.

Check out the SMS OTP form best practices article to learn more: web.dev/articles/sms-otp-form

Here's how it works on Android Chrome

Did you know there's an easy way to streamline SMS OTP entry on your website?

Combining @domain #code at the end of the SMS, autocomplete="one-time-code" on the input tag, and the WebOTP API enables one-tap autofill in Safari on iOS/macOS and Chrome on Android without switching to the SMS app. Because the domain is bound, it won't work on phishing sites.

goo.gleModern Web Guidance | Chrome for DevelopersSkills that embed web platform expertise and best practices directly into your coding agents.

Also, "Modern Web Guidance", our collection of skills for coding agents, now supports these best practices so you can adopt them effortlessly. goo.gle/mwg

Did you know there's an easy way to streamline SMS OTP entry on your website?

scotthelme.co.ukPasskeys Are Not a TrapA post called Passkeys are a trap. Do not use them. has been doing the rounds over the last few days, making it pretty high on Hacker News, and I've had it sent to me many times with an 'is this…

SMS one-time passwords (OTPs) are common for 2FA, but switching apps to type a 6-digit code causes drop-off and carries high phishing risks. Ideally you should adopt passkeys, but there are steps you can take improve your existing SMS OTP today.

Eiji Kitamura / えーじ reposted

Scott Helme

@scotthelme.bsky.social

Quite a few people have sent me the "Passkeys are a trap. Do not use them." post on Substack. The post recommends people abandon passkeys and stick to passwords + TOTP, citing what appears to be concerns with attestation. I’ve written a rebuttal: scotthelme.co.uk/passkeys-are...

Eiji Kitamura / えーじ reposted

Can users sign in without leaving the page? When checking out on travel or ecommerce sites or clicking "Like", you're often sent to a login page. Ever wished you could just sign in on the spot? "Immediate UI mode" lets users sign in with passkeys or saved passwords right before navigation.

Our new UX guide walks through four recommended UX patterns—header sign-in links, ecommerce checkout, micro-actions like "Like", and paywall unlocking—along with anti-patterns you should avoid.

developer.chrome.comEnable quick sign-ins: Immediate UI mode UX patterns | Identity | Chrome for DevelopersExplore recommended UX patterns that boost conversion with Immediate UI mode for quick sign-ins, along with design anti-patterns to avoid.

While currently Chrome-only and not yet in Baseline, `getClientCapabilities()` lets you adopt it as a safe progressive enhancement without disrupting other browsers or Incognito mode. Check it out for your next sign-in design: developer.chrome.com/docs/identit...

Eiji Kitamura / えーじ reposted

blog.agektmr.comWhat is EVP? Bridging the remaining gap in the passkey eraHow the Email Verification Protocol (EVP) solves passkey fallback and account recovery challenges by bringing phishing resistance to email verification without...

Passkeys made signing in phishing-resistant, but we cannot make user accounts truly secure until we rethink how we recover the account. Email Verification Protocol (EVP) may be an answer.

Eiji Kitamura / えーじ reposted

Andrey Sitnik

@en.sitnik.es

Added passkeys to Slow Reader because they make UX much simpler, especially with E2E encryption, where there’s no password recovery. In the LLM era, criteria and UI taste matter most. Two passkey guides from @agektmr.com: web.dev/articles/pas... web.dev/articles/pas...

Passkeys made signing in phishing-resistant, but we cannot make user accounts truly secure until we rethink how we recover the account. Email Verification Protocol (EVP) may be an answer.

While that looks like a great sign-up UX upgrade on the surface, its real significance is how it changes the security equation across the entire account lifecycle.

In my latest blog post, I introduce EVP from the ground up: how it verifies an email address without an inbox trip, and why it is the missing piece in the passkey era. Please give it a read: blog.agektmr.com/en/2026/10/e...

Passkeys made signing in phishing-resistant, but we cannot make user accounts truly secure until we rethink how we recover the account. Email Verification Protocol (EVP) may be an answer.

Today, almost every online service relies on one-time passwords (OTPs) or magic links to confirm an email address. Both force users to leave the browser and open their inbox—and worse, they leave a phishing-vulnerable weak link in the account lifecycle that passkeys alone cannot close.

A new web standard in the works, the Email Verification Protocol (EVP), takes a completely different approach: it enables websites to verify email possession directly inside the browser, without ever sending an email.

Eiji Kitamura / えーじ reposted

Sam Goto

@sgo.to

Really good article from @agektmr.com !! blog.agektmr.com/en/2026/10/e...

Eiji Kitamura / えーじ reposted

Rowan Merewood

@rowan.fyi

📧 More email verification updates! Not anticipating 🤞 more breaking changes, so if you're waiting for things to stabilise before testing, this is the sign. Android support in stable, dedicated docs, and more 👇 https://developer.chrome.com/blog/email-verification-october-2026

ダウンタイム見終わった。めっちゃ面白かったわー。ネタバレは避けてみた方がいいです

developer.chrome.comConnection allowlists: Secure your web application's network access | Blog | Chrome for DevelopersChrome 152 introduces connection allowlists, a new security mechanism that lets you create a strict network sandbox for your documents and workers.

Connection Allowlists announcement blog post has been published. developer.chrome.com/blog/connect...

Eiji Kitamura / えーじ@agektmr.com

"Connection Allowlists," a browser-level security mechanism that blocks any outbound network communication not matching your permitted URL patterns, is now available starting in Chrome 152.

somi.co.jp創味食品創味食品グループは、プロが納得する業務用製品からご家庭用まで、美味しさを追求し、食の世界を豊かにする企業です。

生成AIで作ったCM増えたよなあ。まだ一目で分かるからいいけど、そのうち見分けつかなくなりそう。これでどれだけの仕事が奪われたのか、それとも低予算でも高い経済効果があったかと見るべきか。 www.somi.co.jp/news/28300/

"Responsive iframes" are now available in Chrome 154, letting an iframe size itself to fit the content of the document it embeds.

developer.chrome.comResponsive iframes in Chrome 154 | Blog | Chrome for DevelopersChrome 154 adds support for responsively-sized iframes, letting an iframe size itself based on the intrinsic size of its embedded document.

For now this works only in Chrome and isn't Baseline yet. Also watch out for layout shifts that can hurt CLS. With @supports, you can keep your current approach as a fallback and adopt this step by step. Details and a demo: developer.chrome.com/blog/respons...

Authored by @bram.us and @sebabenz.bsky.social

"Responsive iframes" are now available in Chrome 154, letting an iframe size itself to fit the content of the document it embeds.

Until now, embeds with changing heights, like comment widgets or social posts, meant measuring the content, sending the size to the parent page with postMessage(), and resizing the iframe by hand.

Now the embedding page sets frame-sizing: content-height in CSS, and the embedded document opts in with <meta name="responsive-embedded-sizing">. For cross-origin embeds, allow-origins controls which sites can use the content size.

Eiji Kitamura / えーじ reposted

Philip Walton

@philipwalton.com

15 Sept

If you've ever tried using a new web API in TypeScript, you've probably hit this problem: An API exists. It works in your browser. But TypeScript has no types for it. The reason is a limitation that TS unfortunately applies to its built-in libs. BUT, I've created a relatively simple fix 👇