A passkey is a login credential made of a cryptographic key pair instead of a shared secret. You unlock it with whatever unlocks your phone or laptop (a fingerprint, your face, a PIN), and the website never receives anything it could leak or that you could be tricked into typing somewhere else. Passkeys are the consumer name for FIDO2 credentials, and Apple, Google and Microsoft have supported them since 2022. They fix the two biggest problems with passwords, phishing and reuse, almost completely.

I’ve been dismissive of “proof of human” as a category for a while. It sounded like a solution chasing a problem that mostly affected crypto airdrops and dating app catfish, not something a platform with three billion users needed to solve. I was wrong about the addressable market, if not about the mechanism. Meta launched Facebook Verified, a free program that checks a facial recognition selfie and assigns a badge confirming you’re a real person.

A working reference for the language of modern cybersecurity — organized by threat surface and defensive domain. Definitions are written for security professionals, technical managers, and informed practitioners who need precision without padding. Threat Actors and Motivation Advanced Persistent Threat (APT) A sophisticated, long-duration cyberattack campaign — typically state-sponsored — characterized by stealth, patience, and a specific high-value target. APT actors infiltrate networks and maintain persistent access for months or years before executing their objective.

Zero trust begins with a kind of uncomfortable admission: the network is no longer a safe boundary. For years, security was built around the idea that once you were “inside,” you were mostly trusted. Firewalls guarded the perimeter, and anything beyond that line operated with fewer questions asked. That model made sense when systems were centralized and users sat in predictable locations. It doesn’t hold up anymore. Work happens across cloud platforms, personal devices, remote connections, third-party integrations—there isn’t a clean inside or outside anymore, just a constantly shifting surface of interactions.

“Referenced by X” looks like a small detail, almost decorative at first glance. A name attached to an idea, a link to a person behind a recommendation. Easy to overlook. But that simple attribution changes how information is interpreted more than most people realize. Without attribution, content exists in a kind of neutral space. It might be useful, well-written, even accurate—but it lacks orientation. You don’t know who stands behind it, what their perspective is, or why they’re presenting it in that particular way.

The CV had a good run. For decades, it served as the default container for professional identity—a neat, linear story of where you’ve been and what you’ve done. Titles, dates, bullet points, maybe a few quantified achievements if you were paying attention. It was simple, portable, and, for a long time, good enough. But somewhere along the way, it started to feel less like a reflection of reality and more like a carefully edited narrative.

Something has been off about professional references for a while now, even if most people haven’t quite said it out loud. You scroll through profiles, endorsements, recommendations—everything looks polished, consistent, almost frictionless. Too frictionless, maybe. The signal is there, but it’s buried under a layer of performative credibility that feels more like formatting than proof. LinkedIn didn’t break professional references, it standardized them to the point where differentiation became harder.

Reputation used to be local. You built it in a company, a community, a city—somewhere bounded, where people could remember what you did and adjust their trust accordingly. The internet expanded that scope, but it also fragmented it. Now your reputation is scattered across platforms, each holding a piece of the picture, none of them talking to each other. A five-star rating here, a profile there, a trail of comments somewhere else.