DEV Community: Guru X Blog

Passkeys Explained: Why the Password Is Finally Starting to Disappear

Guru X Blog — Sun, 01 Nov 2026 08:57:09 +0000

For years, "just use a stronger password" was the best advice anyone could give, even though the advice never really solved the problem — people reused passwords, wrote them down, or picked ones that were easy to guess. Passkeys are the first serious attempt to fix this by removing the password from the equation entirely, rather than just making it longer.

How a passkey actually works

When you set up a passkey, your device creates two mathematically linked keys: a private key that stays on your device, and a public key that's sent to the website. To log in, the website asks your device to prove it holds the matching private key, which your device does using your fingerprint, face scan, or screen lock — no secret ever travels over the internet, so there's nothing for a phishing site or a breached database to steal.

Why this is a genuinely bigger deal than it sounds

Nothing to type means nothing to forget, reuse, or leak in a breach
Phishing sites can't trick you into handing over a passkey the way they can with a password, because the passkey is tied to the real website's identity
Most major platforms — Apple, Google, Microsoft — now support passkeys, so adoption isn't limited to a single ecosystem

The rough edges, honestly

Syncing across devices and platforms still isn't perfectly smooth, some websites offer passkeys but bury the option deep in account settings, and if you lose access to your device and your cloud account at the same time, recovery can be more involved than resetting a password used to be.

Should you turn passkeys on?

For any account that supports them — email, banking, cloud storage — yes, it's worth setting up. Keep a password as backup where the site allows it, but a passkey is a real security upgrade, not just a convenience feature.

Frequently Asked Questions

What exactly is a passkey?

A passkey is a cryptographic key pair generated by your device that replaces a traditional password. Instead of typing a secret, you unlock it with your fingerprint, face, or device PIN, and the actual verification happens using math that never leaves your device.

Are passkeys actually more secure than passwords?

Yes, in a meaningful way. Passkeys can't be phished, reused across sites, or leaked in a data breach the way a shared password can, because the private half of the key never leaves your device or gets sent to the website you're logging into.

What happens if I lose my phone?

Most passkey systems sync your keys through your device's cloud account (like iCloud Keychain or Google Password Manager), so signing in on a new device usually just requires proving it's really you via that account, similar to restoring any other synced data.

Do I still need passwords at all?

For now, yes, mostly as a fallback. Most sites that support passkeys still keep a password option, and older accounts and services will take years to fully transition, so it's less an overnight replacement and more a gradual shift.

Related reading on Guru X Blog:

Originally published at Guru X Blog. AI, security & gadgets, made simple — more at guruxurl.tech/blog.

How Large Language Models Like ChatGPT Actually Work, in Plain English

Guru X Blog — Sun, 01 Nov 2026 08:57:06 +0000

Chatbots like ChatGPT can write emails, explain ideas and answer questions in a way that feels remarkably human. It's natural to wonder what's going on underneath. The core idea is surprisingly simple to describe, even if building one is not: a large language model is a system that has become extremely good at predicting what text should come next.

Predicting the next piece of text

Language models don't read words quite the way we do. They break text into small chunks called tokens — often a whole word, sometimes part of one, sometimes a punctuation mark. Given a sequence of tokens, the model calculates which token is most likely to come next, adds it, then repeats the process. A full answer is built one token at a time.

That sounds too basic to produce a thoughtful reply, but predicting the next token well turns out to require picking up a great deal about grammar, facts, reasoning patterns and style.

How the model learns

Pre-training — the model is shown an enormous amount of text and repeatedly asked to predict missing or next tokens, adjusting itself slightly every time it's wrong

Parameters — what it learns is stored as a huge set of numbers that shape how it responds, rather than as a library of saved documents

Fine-tuning — the model is then trained further on examples of helpful conversations, often with people rating answers, so it behaves more like an assistant

The transformer and attention

Most modern language models use a design called the transformer. Its key ingredient is a mechanism called attention, which lets the model weigh how much each earlier token matters when predicting the next one. In the sentence "The trophy didn't fit in the case because it was too big," attention is part of how the model can connect "it" with the trophy rather than the case.

What happens when you send a message

Your message, along with the earlier conversation and any hidden instructions the service adds, is turned into tokens and fed to the model. The amount of text it can consider at once is called its context window. The model then generates a reply token by token. A small amount of randomness is usually built in, which is why asking the same question twice can produce different wording.

Memory is more limited than it seems

Within a conversation, the model "remembers" earlier messages only because they're sent back to it each time as part of the context. Once a conversation is long enough to exceed the context window, older parts can drop out. Some products add separate memory features, but those are extra systems built around the model.

Why they get things wrong

Because the model is trained to produce plausible text rather than to look things up, it can state something false with complete confidence. This is often called hallucination. It's more likely with obscure topics, precise figures, citations and recent events that happened after its training data was collected. Services that connect the model to search or documents can reduce this, but not eliminate it.

Using them sensibly

Language models are excellent for drafting, summarising, brainstorming and explaining concepts. They're less reliable as a final source of truth. A good rule is to treat an answer like advice from a well-read friend: often helpful, sometimes wrong, and worth double-checking whenever the details genuinely matter.

Frequently Asked Questions

Does a language model understand what it's saying?

That's debated. What's clear is that it works by predicting likely text based on patterns learned in training. It can produce useful, sensible answers, but it doesn't check facts against the world the way a person looking things up would.

Why do chatbots sometimes make things up?

Because the model's job is to produce plausible-sounding text, not to retrieve verified facts. When it lacks reliable information, it can still generate a confident answer that happens to be wrong. This is often called hallucination.

Does a chatbot learn from my conversations?

Within a single chat, it can refer back to earlier messages. Whether your conversations are later used to train or improve models depends on the provider and your settings, so it's worth checking the privacy options of any service you use.

Can a language model access the internet?

The model on its own only knows what was in its training data. Some chat products connect it to web search or other tools, which lets it pull in current information — but that's an added feature, not something the model does by itself.

Related reading on Guru X Blog:

Originally published at Guru X Blog. AI, security & gadgets, made simple — more at guruxurl.tech/blog.

Is Public Wi-Fi Safe? What Actually Puts You at Risk

Guru X Blog — Sun, 01 Nov 2026 08:57:02 +0000

For years, the standard advice was simple: never use public Wi-Fi for anything important. That warning made a lot of sense when most websites sent information in plain text. Today the picture is different. Most of the web now runs over encrypted connections, which removes the biggest danger people used to worry about — but it doesn't make every free hotspot harmless. The risks have shifted, and knowing where they actually are is more useful than avoiding public networks altogether.

What changed: encryption is now the default

When a site uses HTTPS, the connection between your device and that site is encrypted. Someone else on the same café network may be able to tell that you're connecting to a particular service, but they can't read the pages you load, the passwords you type, or the messages you send. Banking apps, email providers, social networks and popular messaging apps all encrypt their traffic as a matter of course. Browsers also warn loudly when a site isn't secure, and many now try to upgrade connections to HTTPS automatically.

That means the classic picture of a stranger at the next table quietly reading your emails is far less realistic than it used to be.

The risks that still matter

Fake networks — an attacker can set up a hotspot named after the venue, often called an "evil twin", and wait for people to join it
Fake login pages — once someone controls the network, they can redirect you to a convincing copy of a sign-in page and collect whatever you type
Captive portals that ask too much — a Wi-Fi sign-up page that wants your email password or card details is a red flag, not a normal step
Open file sharing — laptops set to share folders or allow discovery on a "home" network can expose more than you intend on a public one
Out-of-date devices — an unpatched phone or laptop is easier to attack on any network, and public ones put you next to more strangers

Why the network name isn't proof of anything

Anyone can name a hotspot anything they like. Two networks with the same name, or a suspiciously generic one like "Free Airport WiFi", are worth a second look. If you're not sure which network is official, ask staff or check a sign at the venue before connecting.

Simple habits that cover most of the risk

Check for the padlock or the site's normal address before entering a password, and back out if your browser shows a certificate warning
Prefer apps over browser logins for banking and email, since apps connect directly to the service rather than through a page you might be redirected away from
Mark public networks as "public" when your laptop asks, which turns off device discovery and file sharing
Turn off auto-join for networks you only used once, so your device doesn't reconnect to a look-alike later
Keep your operating system and browser updated

Where a VPN or hotspot fits in

A reputable VPN encrypts everything leaving your device and sends it through a server you've chosen, so the local network sees very little. It's a sensible extra for frequent travellers or anyone who regularly works from cafés. Using your phone's own hotspot is another easy option — it's a network you control, which sidesteps the fake-network problem entirely.

Public Wi-Fi isn't the danger it once was, but it rewards a little attention. Join the right network, watch for odd login pages and warnings, and keep your devices updated, and you've dealt with the risks that actually matter.

Frequently Asked Questions

Can someone on the same café Wi-Fi read my messages?

Not if the app or website uses encryption, which almost all mainstream messaging apps, banks and email services now do. Someone else on the same network can usually see which services your device is talking to, but not the contents of an encrypted connection.

Do I need a VPN on public Wi-Fi?

It's a useful extra layer rather than a must-have. A VPN hides which sites you visit from the network operator and anyone else on it, and protects any traffic that isn't already encrypted. For most everyday browsing on HTTPS sites, the bigger risks are fake networks and fake login pages.

What is an evil twin network?

It's a Wi-Fi hotspot set up by an attacker with a name that looks legitimate, such as the name of the café or airport you're in. If you connect to it, the attacker controls the network and can try to redirect you to fake pages or push misleading prompts.

Is using my phone's mobile hotspot safer than public Wi-Fi?

Generally yes. A hotspot from your own phone is a network you control, protected by your own password, so you avoid both strangers on the same network and the risk of joining a look-alike hotspot by mistake.

Related reading on Guru X Blog:

Originally published at Guru X Blog. AI, security & gadgets, made simple — more at guruxurl.tech/blog.