The Curious Engineer

All blogs / Security

Pomcor

pomcor.com

Research on web and mobile technology

SecurityWeb development

’15’20’25
Posts
131 from 7 Mar 2011 to 6 Oct 2026
Posting
now and then (3 in the last year)
Kind
company blog
Feed
https://pomcor.com/feed/

2026 3

  1. Passkey-fused credentials: definition, protocols and use cases
  2. Making a third-party credential available on multiple devices by issuing it to the user’s sync fabric
  3. On-demand cross-device replication of a driver’s license credential

2025 3

  1. A driver’s license credential usable for website registration and traffic stops
  2. Unlocking passkey adoption with a more secure and more convenient way of using passkeys
  3. Using a browser as a credential wallet

2024 1

  1. A Definition of Special Soundness Better Suited for Anonymous Credentials

2023 5

  1. Overview of ISO/IEC 18013-5: Innovations and Vulnerabilities in the mDL Standard
  2. A Streamlined Process for Licensing a Cryptographic Authentication Patent
  3. A Demonstration of Two-Factor Cryptographic Authentication with a Familiar User Experience
  4. A Brief Overview of Cryptographic Authentication with a Discussion of Three Hot Topics
  5. FIDO2 and WebAuthn have momentum but won’t help if they are not used

2022 8

  1. Overcoming the UX Challenges Faced by FIDO Credentials in the Consumer Space
  2. A User Experience for Strong Authentication in the Consumer Space
  3. Strong Authentication for the Consumer Space
  4. Comparative Security Analysis of Three Cryptographic Authentication Solutions for the Web
  5. Passwordless Authentication for the Consumer Space
  6. Pomcor Releases PJCL 1.0.0 on GitHub and npm and Deprecates the Beta Versions of the Pomcor JavaScript Cryptographic Library
  7. Identity in a Zero Trust Architecture
  8. Ken Cone joins Pomcor as CFO

2021 5

  1. Pomcor Granted Patent on Frictionless Cardholder Authentication
  2. The 0-RTT Feature of TLS 1.3 Can Be Used As an Encrypted Steganographic Channel to Operate a Backdoor into an Enterprise Network
  3. Nubeva Explains How It handles TLS 1.3 Key Updates in Response to Pomcor Blog Post
  4. A Survey of Existing and Proposed TLS Visibility Solutions
  5. A Two-Version Visibility Solution for TLS 1.2 and TLS 1.3 based on a Handshake-Agnostic Middlebox

2020 9

  1. Extending the TLS 1.3 Visibility Solution to Include PSK and 0-RTT
  2. Protocol-Level Details of the TLS 1.3 Visibility Solution
  3. Reconciling Forward Secrecy with Network Traffic Visibility in Enterprise Deployments of TLS 1.3
  4. Pomcor Granted Patent on How to Implement a PKI on a Blockchain
  5. Request for Comments: A Possible-Worlds Semantics for Kolmogorov’s Axiomatization of Probability Theory
  6. Airport Security in the Age of COVID-19
  7. IN LOVING MEMORY OF KAREN LEWISON
  8. Identity Verification: A Coronavirus Challenge to the Financial World
  9. Pomcor Granted Patent on Rich Credentials

2019 10

  1. A New Tool Against the Surge of Application Fraud
  2. PSD2 Is In Trouble: Will It Survive?
  3. Will Cardholder Authentication Ever Come to the US?
  4. 3-D Secure 2 May Allow the Merchant to Impersonate the Cardholder
  5. Online Cardholder Authentication without Accessing the Card Issuer’s Site
  6. A Formal Proof of Omission-Tolerant Integrity Protection
  7. Mapping a Formal Definition of Collision Resistance to Existing Implementations of Hash Functions
  8. Using an Omission-Tolerant Checksum for Selective Disclosure of Attributes Asserted by a Public Key Certificate
  9. An Omission-Tolerant Cryptographic Checksum
  10. Pomcor Contributes Biometrics Chapter to HCI and Cybersecurity Handbook

2018 13

  1. New Conference to Address the Human Aspects of Cybersecurity and Cryptography
  2. Frictionless Secure Web Payments without Giving up on Cardholder Authentication
  3. Random Bit Generation with Full Entropy and Configurable Prediction Resistance in a Node.js Application
  4. Login Session Maintenance in Node.js using Express and Handlebars
  5. Credential Registration for Cryptographic Authentication with Node.js and MongoDB
  6. Cryptographic authentication with Node.js and MongoDB
  7. A Bypass of the Firefox POST Redirection Bug
  8. Cryptographic Authentication Is Not That Easy After All
  9. Pomcor Granted Patent on Multifactor Cryptographic Authentication
  10. Easy, Password-Free, Cryptographic Authentication for Web Applications
  11. PJCL Can Now Be Used in Node.js Server-Side Code Exactly as in the Browser
  12. Second Release of PJCL Expands Functionality Following NIST Cryptographic Specifications
  13. Pomcor Releases JavaScript Cryptographic and Big Integer Library

2017 3

  1. Storing Cryptographic Keys in Persistent Browser Storage
  2. What kind of “encrypted fingerprint template” is used by MasterCard?
  3. Comments on the Recommended Use of Biometrics in the New Digital Identity Guidelines, NIST SP 800-63-3

2016 7

  1. Using Near-Field Communication for Remote Identity Proofing
  2. Remote Identity Proofing Discussed at the Internet Identity Workshop
  3. Implementing a PKI on a Blockchain
  4. Rich Credentials for Three-Factor Identity Verification without Prior Relationship
  5. Pomcor Receives DHS Grant to Look for Alternatives to Knowledge-Based Verification for Remote Identity Proofing
  6. Revocable Biometrics Discussion at the Internet Identity Workshop
  7. NSA’s FAQs Demystify the Demise of Suite B, but Fail to Explain One Important Detail

2015 9

  1. Cryptographic Module Standards at a Crossroads after Snowden’s Revelations
  2. Faster Modular Exponentiation in JavaScript
  3. Has Bluetooth Become Secure?
  4. NIST Looks at EMV to Speed up Physical Access with PIV Contactless Cards
  5. Highlights of the NIST Worshop on PIV-Related Special Publications
  6. Biometrics and Derived Credentials
  7. Biometrics in PIV Cards
  8. NIST Omits Encryption Requirement for Derived Credentials
  9. NIST Fails to Address Concerns on Derived Credentials

2014 16

  1. Virtual Tamper Resistance is the Answer to the HCE Conundrum
  2. How Apple Pay Uses 3-D Secure for Internet Payments
  3. Making Sense of the EMV Tokenisation Specification
  4. Implementing Virtual Tamper Resistance without a Secure Channel
  5. Which Flavor of Tokenization is Used by Apple Pay
  6. Smart Cards, TEEs and Derived Credentials
  7. Apple Pay Must Be Using the Mag-Stripe Mode of the EMV Contactless Specifications
  8. Security Weaknesses of Apple Pay for In-Store Transactions
  9. Apple Pay, EMV and Tokenization
  10. On the Security of Apple Pay
  11. Forthcoming Presentation at the GlobalPlatform TEE Conference
  12. Identity-Based Protocol Design Patterns for Machine-to-Machine Secure Channels
  13. Invited Talk at the University of Utah
  14. Patent Illustrates Five Different Problems with Software Patents
  15. Derived Credentials in a Trusted Execution Environment (TEE)
  16. Protecting Derived Credentials without Secure Hardware in Mobile Devices

2013 11

  1. It’s Time to Redesign Transport Layer Security
  2. Surveillance and Internet Identity
  3. Pomcor Granted Patent on Method of Browsing Real-Time Search Results
  4. Feedback on the Paper on Privacy Postures of Authentication Technologies
  5. Comparing the Privacy Features of Eighteen Authentication Technologies
  6. Two Methods of Cryptographic Single Sign-On on Mobile Devices
  7. Using Cryptographic Authentication without a Cryptographic API on iOS and Android Devices
  8. Strong Authentication with a Low-Entropy Biometric Key
  9. Defense in Depth of Cryptographic Credentials on a Mobile Device
  10. Closed-Loop vs. Open-Loop Authentication
  11. New Research on Mobile Authentication

2012 10

  1. Consistent Results from Inconsistent Data
  2. Report on the NIST Cryptographic Key Management Workshop
  3. Effective Data Protection for Mobile Devices
  4. Techniques for Implementing Derived Credentials on Mobile Devices
  5. Convenient One-, Two- and Three-factor Authentication for Mobile Devices
  6. A Protocol for Social Login in the Age of Mobile
  7. NSTIC Is Not Low-Hanging Fruit
  8. One-Click OpenID: A Solution to the NASCAR Problem
  9. OpenID Providers Invited to Join in an NSTIC Pilot Proposal
  10. After CardSpace, Microsoft Calls for Research on Passwords

2011 18

  1. Credential Sharing: A Pitfall of Anonymous Credentials
  2. Trip Report: Meeting on Privacy-Enhancing Cryptography at NIST
  3. Do-Not-Track and Third-Party Login
  4. Benefits of TLS for Issuing and Presenting Cryptographic Credentials
  5. Deployment and Usability of Cryptographic Credentials
  6. Are Privacy-Enhancing Technologies Really Needed for NSTIC?
  7. Pros and Cons of Idemix for NSTIC
  8. Pros and Cons of U-Prove for NSTIC
  9. Pomcor’s Comments on the Cybersecurity Green Paper
  10. Pomcor’s Response to the NSTIC Notice of Inquiry
  11. BrowserID and NSTIC
  12. A Proposed Architecture for the NSTIC Ecosystem
  13. Altly Needs PKAuth
  14. Must the Site know the Application in a Social Login?
  15. Browsing Real Time Search Results
  16. Thoughts about NSTIC after NIST IDtrust Workshop
  17. Social Login without Application Registration
  18. Welcome to the Pomcor Blog