Arken is passwordless authentication middleware for Express and FastAPI built around decentralized identifiers and secp256k1 signatures. A client first requests a protected resource and receives a 401 response with a one-time nonce. It signs that nonce with its private key, then sends the signature and its `did:key` identifier in an Authorization header. The server verifies the nonce, recovers the signer from the signature, and checks that the signer matches the DID before granting access. Private keys stay on the client, and the design avoids passwords, user-account databases, and persistent login sessions; the server does temporarily store each challenge, with a 60-second lifetime.
The cryptographic engine is written in Rust and exposed to Node.js and Python through FFI wrappers. Arken’s DIDs encode compressed secp256k1 public keys using the DID Key method and base58btc. Its main claimed advantage over WebAuthn is that an identity can travel across services and devices rather than being tied to one website origin; clients need only be able to sign Ethereum messages. The project describes its first phase as working middleware with a completed, tested cryptographic core. Building currently requires Rust, while planned work includes prebuilt binaries, optional sessions or tokens, support for additional DID methods, and a browser-extension wallet.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Hackers stole about $6.3 billion in cryptocurrency from Binance wallets across at least 10 blockchains, draining most of it in roughly 20 minutes. Investigators suspect North Korea’s TraderTraitor group; Binance and other firms have frozen about half the funds, while much of the rest may be unrecoverable. (wired.com)
Official Claude Code extensions were found to contain backdoors. The issue raises security concerns for users who install those extensions. (cyberplace.social)
A compromised Claude Code extension version 2.1.313 distributed malware that collected developer device details and attempted to install a persistent SSH backdoor. Anthropic replaced the extension with version 2.1.314, but affected devices may still need remediation. (doublepulsar.com)
A compromised Claude Code extension version 2.1.313 attempted to steal device information and install a persistent SSH backdoor on developer computers. Anthropic replaced the extension, but the update does not remove backdoors from devices already infected. (doublepulsar.com)
Researchers report five full cross-tenant compromises in Azure linked to a common underlying weakness. The cases highlight risks to tenant isolation in Microsoft’s cloud platform. (binarysecurity.no)
Binance’s hot wallet signed 50 EIP-7702 authorizations, then a contract drained about $2.5-$2.8 billion from it three minutes later. The timing raises questions about whether the wallet’s private key was compromised or misused. (808bits.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.